https://community.splunk.com/t5/Getting-Data-In/How-to-define-specific-Splunk-indexers-for-different/m-p/124977#M25772 <P>In your inputs.conf for the app, you can specify the index that the data source goes into. Something like:</P> <PRE><CODE>inputs.conf in App A [monitor:///appA-sourcetype1] sourcetype=appA-logfile index=appA_index inputs.conf in App B [monitor:///appB-sourcetype1] sourcetype=appB-logfile index=appB_index </CODE></PRE> <P>It should be noted that if you have the same sourcetype defined across multiple apps, then your configurations will be read in lexicographical order.</P> Wed, 01 Apr 2015 21:50:08 GMT esix_splunk 2015-04-01T21:50:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-define-specific-Splunk-indexers-for-different/m-p/124976#M25771 <P>I have a requirement to log the default Windows logs using the universal forwarder to our main Splunk server, and then we have another application that needs to send logs to a different set of Splunk indexers.</P> <P>I am pushing the applications to the UF host via a deployment server, however how do I specify that Application B use a different set of indexers? </P> <P>I think I have a conflict in the outputs.conf when I have both Application A and Application B deployed to the UF host. The outputs.conf files are located in each of the /apps/ApplicationA/default and /apps/ApplicationB/default folders. </P> <P>If I have just Application A or Application B pushed on their own, the required data is pushed to the correct Splunk indexer(s). Both installed at the same time ceases to send out anything. </P> Wed, 01 Apr 2015 21:16:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-define-specific-Splunk-indexers-for-different/m-p/124976#M25771 scottroymcse 2015-04-01T21:16:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-define-specific-Splunk-indexers-for-different/m-p/124977#M25772 <P>In your inputs.conf for the app, you can specify the index that the data source goes into. Something like:</P> <PRE><CODE>inputs.conf in App A [monitor:///appA-sourcetype1] sourcetype=appA-logfile index=appA_index inputs.conf in App B [monitor:///appB-sourcetype1] sourcetype=appB-logfile index=appB_index </CODE></PRE> <P>It should be noted that if you have the same sourcetype defined across multiple apps, then your configurations will be read in lexicographical order.</P> Wed, 01 Apr 2015 21:50:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-define-specific-Splunk-indexers-for-different/m-p/124977#M25772 esix_splunk 2015-04-01T21:50:08Z