topic Re: Change indexer in Getting Data In

Change indexer

toporagno — Tue, 16 Jan 2024 14:12:13 GMT

i need to change a indexer for a data send by a universal forward, i've this data source_type="pippo" with sourcetype:"paperino" and index="pluto" so i need to send all of this data in another index like index="nino"

i try with a props.conf and transforms.conf but it doesn't work

Re: Change indexer

gcusello — Tue, 16 Jan 2024 14:58:58 GMT

Hi @toporagno,

At first how are you taking these logs: from a Universal Forwarder or from an Heavy Forwarder or another Splunk server?

if you are using a UF, I suppose that you are using a Deployment Server to manage it, so in the inputs.conf, you could add the sourcetype and the index.

IOf instead you are receiving a syslog in an HF, you have to apply the same update to the related inputs.conf.

You could alse override the index and sourcetype on the Indexer, or (if present) on the HF, but it's easier modifying the inputs.conf.

Ciao.

Giuseppe

Re: Change indexer

toporagno — Tue, 16 Jan 2024 15:18:15 GMT

i use a UF

Re: Change indexer

gcusello — Tue, 16 Jan 2024 15:44:08 GMT

Hi @toporagno ,

this means that you have to manually or by Deployment Server update your inputs.conf stanza in the Universal Forwarder, adding the lines for index and sourcetype.

Ciao.

Giuseppe

Re: Change indexer

toporagno — Tue, 16 Jan 2024 16:08:20 GMT

Can you write me an practive example?

please

Re: Change indexer

gcusello — Wed, 17 Jan 2024 07:36:57 GMT

Hi @toporagno,

Icould be more detailed if you share your inputs.conf in the forwarder.

anyway, you should have somethig like this:

[monitor://C:\my_directory\my_file.log] index=my_index sourcetype=my_sourcetype disabled=0

As I said, if you have few Universal Forwarders, you can manually modify all the inputs.conf, if they are many, you should think to use a Deployment Server, but this is another project.

For more infos about DS, you can see at https://docs.splunk.com/Documentation/Splunk/9.1.2/Updating/Aboutdeploymentserver

Ciao.

Giuseppe