topic Re: winevent index location in Getting Data In

winevent index location

a212830 — Mon, 13 Jan 2014 02:26:54 GMT

Hi,

I have a customer who configured a universal forwarder and now wants to send their files to my indexer. I do not want to use "main" as the index, however. I can't find where the index association is for winevent logs. Can someone point me to it?

Re: winevent index location

dstaulcu — Mon, 13 Jan 2014 03:20:50 GMT

Inputs.conf

index =

Sets the index to store events from this input.
Primarily used to specify the index to store events coming in via this

input stanza.

Detail: Sets the index key's initial value. The key is used when

selecting an index to store the events.

Defaults to "main" (or whatever you have set as your default index).

Re: winevent index location

a212830 — Tue, 14 Jan 2014 13:18:52 GMT

Thanks. I realize the inputs.conf is where the indexer gets identified, I was looking for which inputs.conf is used for windows events. I found it in the MsiCreated directory.

Re: winevent index location

dstaulcu — Tue, 14 Jan 2014 23:39:42 GMT

For future reference, If you run .\bin\splunk.exe cmd bool inputs list --debug on the agent in question it will list input settings in effect and the input.conf instances from which those settings are derived.