topic Change Universal forwarder metrics from _internal index to another index possible? in Deployment Architecture

Change Universal forwarder metrics from _internal index to another index possible?

hethu — Wed, 01 Dec 2021 12:39:25 GMT

Hi,

I want to monitor a whole bunch of Universal Forwarders that i have set up and configured. All data from these are all forwarded to a heavy forwarder that forwards everything to Splunk Cloud.

My problem is that i have only access to one index in the cloud, but not the _internal index that receives UF metrics. Is it possible to change the index from _internal to the one I have access to in the UF config?

Re: Change Universal forwarder metrics from _internal index to another index possible?

richgalloway — Wed, 01 Dec 2021 14:09:39 GMT

While, in theory, it may be possible to have the data go to a different index, I advise against it. First, some of the references to _internal may be hardcoded so you won't be able to change 100% of the events. Second, making such a change may have side effects such as built-in dashboards and alerts no longer working. Finally, data written to _internal is free whereas sending to a different index will count against your license.