topic Does Splunk Index Everything on the Server? in Getting Data In

Does Splunk Index Everything on the Server?

skoelpin — Wed, 29 Jul 2015 19:52:50 GMT

I have 3 servers which process web service calls and are being indexed by Splunk. I specified their index in the inputs.conf on the forwarder as index=uvtrans and their sourcetype is ATG_Message_Log.. So now I see in Splunk 2 different sources coming in named WinEventLog.Application and WinEventLog.Systemwhich are in index=main which means their index was not specified on the forwarder so it defaults there. I'm looking in Splunk_Home/etc/system/local/inputs.conf on all 3 boxes and I do not see anywhere where WinEventLog is located. I've looked through all the conf files and cannot find it.

Does Splunk index EVERYTHING on that server regardless if it's been specified in my conf files? How can I exclude the WinEventLog sources from being indexed by Splunk?

Re: Does Splunk Index Everything on the Server?

somesoni2 — Wed, 29 Jul 2015 21:56:36 GMT

There can be other inputs.conf available under Splunk_HOme/etc/apps/AppNamesHere/ under local and default folder. Have a look there.

Re: Does Splunk Index Everything on the Server?

hgrow — Thu, 30 Jul 2015 08:02:45 GMT

If you are searching for lost configurations splunks btool can be helpful:

splunk cmd btool [conf file name] list --debug

In your case you would run

splunk cmd btool inputs list --debug

Hope it helps.

Re: Does Splunk Index Everything on the Server?

pwmcity — Thu, 30 Jul 2015 08:22:47 GMT

Looks like you might have the Windows TA installed, it collects data with those sourcetypes
http://docs.splunk.com/Documentation/WindowsApp/4.7TA/User/AbouttheSplunkTechnologyAdd-on(TA)forWindows