topic Re: Both universal forwarders have the same inputs.conf, but why is the index of data changing based on which machine it comes from? in Getting Data In

Both universal forwarders have the same inputs.conf, but why is the index of data changing based on which machine it comes from?

nce054 — Fri, 19 Jun 2015 19:17:17 GMT

I'm gathering data from two machines, and depending on which one it comes from, it has a different index. Both universal forwarders have the same inputs.conf which looks like

[monitor://C:\Windows\.marimba\MarimbaEndpointTuner\history-y*.log]
disabled=0
index = main
sourcetype = marimba

Can anyone think of a reason as to why they are being put in separate indexes?

Re: Both universal forwarders have the same inputs.conf, but why is the index of data changing based on which machine it comes from?

martin_mueller — Fri, 19 Jun 2015 19:24:59 GMT

Check your indexer for transforms.conf rules that overwrite the index based on some criterion.

Re: Both universal forwarders have the same inputs.conf, but why is the index of data changing based on which machine it comes from?

nce054 — Fri, 19 Jun 2015 20:03:58 GMT

Got the problem fixed. I went under \apps\learned and deleted all of the contents in each folder on the Universal Forwarders. Now, they both are coming up with an index of main. Thanks for the suggestion.

Re: Both universal forwarders have the same inputs.conf, but why is the index of data changing based on which machine it comes from?

nce054 — Fri, 19 Jun 2015 20:08:48 GMT

Got the problem fixed. I went under appslearned and deleted all of the contents in each folder on the Universal Forwarders. Now, they both are coming up with an index of main. Thanks for the suggestion.