https://community.splunk.com/t5/Getting-Data-In/Sending-forwarder-events-to-a-specific-index/m-p/108314#M22792 <P>Okay, I'm not exactly a new user to Splunk, but I'm new to using a forwarder. In this case, it's a "heavy forwarder". I set the remote hostname as my main Splunk receiver, and configured the receiver to receive on a given port. The problem is that the events from the remote forwarder go into the "main" index. How do I specify an index the forwarded data should go to? </P> Thu, 23 Dec 2010 03:31:51 GMT tedder 2010-12-23T03:31:51Z https://community.splunk.com/t5/Getting-Data-In/Sending-forwarder-events-to-a-specific-index/m-p/108314#M22792 <P>Okay, I'm not exactly a new user to Splunk, but I'm new to using a forwarder. In this case, it's a "heavy forwarder". I set the remote hostname as my main Splunk receiver, and configured the receiver to receive on a given port. The problem is that the events from the remote forwarder go into the "main" index. How do I specify an index the forwarded data should go to? </P> Thu, 23 Dec 2010 03:31:51 GMT https://community.splunk.com/t5/Getting-Data-In/Sending-forwarder-events-to-a-specific-index/m-p/108314#M22792 tedder 2010-12-23T03:31:51Z https://community.splunk.com/t5/Getting-Data-In/Sending-forwarder-events-to-a-specific-index/m-p/108315#M22793 <P>On your forwarder, add <CODE>index=blah</CODE> in to your stanza in inputs.conf:</P> <PRE><CODE>[monitor:///var/log/foo] sourcetype=helloworld index=blah </CODE></PRE> Thu, 23 Dec 2010 04:00:18 GMT https://community.splunk.com/t5/Getting-Data-In/Sending-forwarder-events-to-a-specific-index/m-p/108315#M22793 ftk 2010-12-23T04:00:18Z