topic Re: Where are TCP and UDP inputs indexed? in Getting Data In

Where are TCP and UDP inputs indexed?

lguinn2 — Sat, 06 Feb 2010 05:38:54 GMT

When I configure network inputs (TCP or UDP), I provide the port number and sourcetype, but there is nowhere to specify the index. Where are these inputs indexed? Can I change the index that is used for network inputs?

Re: Where are TCP and UDP inputs indexed?

V_at_Splunk — Sat, 06 Feb 2010 05:52:14 GMT

Unless otherwise specified, all data goes into the default index.

If adding network input through CLI, you can specify index with the -index option. (Issue splunk help add for syntax help.)

If adding network input through Manager » Data inputs » TCP » Add New or Manager » Data inputs » UDP » Add New, you should see an Index dropdown list. Is it there? What version are you using, please?

Re: Where are TCP and UDP inputs indexed?

lguinn2 — Sat, 06 Feb 2010 06:01:31 GMT

version 4.0.9, build 74233

But there is no Index dropdown list in the web UI for either TCP or UDP inputs

Re: Where are TCP and UDP inputs indexed?

hulahoop — Sat, 06 Feb 2010 06:21:39 GMT

Since that is the sad case, then you must edit inputs.conf where the network input is defined and add the "index=foo" parameter to the input stanza.

Re: Where are TCP and UDP inputs indexed?

Gaurav — Sat, 06 Feb 2010 06:37:34 GMT

In 4.0.x, you are indeed required to manually edit inputs.conf to specify an index for UDP/TCP inputs.

In 4.1, we'll be exposing index, host, and source configuration for all input types within Splunk Manager. In addition you'll be able to blacklist/whitelist from the UI for monitor inputs.

Re: Where are TCP and UDP inputs indexed?

balbano — Thu, 08 Jul 2010 04:26:49 GMT

Is there someway to setup listening to one port and have it direct logs to a specific index depending on whitelist/blacklist?

What I mean is can you setup logs to go to multiple indexes through 1 listening port (e.g. TCP 514).

Brian