topic Re: How to forward Windows event log "application" to 2 different indexes? in Getting Data In

How to forward Windows event log "application" to 2 different indexes?

KooroshFooladba — Mon, 28 Sep 2020 18:34:34 GMT

Our Splunk 6.1.5 environment is on Linux. We have universal forwarders installed on our windows machines. They are already forwarding data to index "os_windows". I have another index "test_application_index" that some of my servers are forwarding other types of logs. Now, I also need to forward the Windows event log "application" to this "test_application_index".
I know that I can add the following lines to "inputs.conf" file for the second app(index), but I am not sure if it is the correct way as we already have this information in "os_windows" and by doing this, we are indexing that data twice.

Any suggestions?

[WinEventLog:Application]
disabled = false
index=test_application_index

Re: How to forward Windows event log "application" to 2 different indexes?

alacercogitatus — Tue, 06 Jan 2015 19:28:22 GMT

You probably want an eventtype here. Then you can specify where your data lives a little more granular. Do this on the Searchheads and Indexers.

eventtypes.conf
[wineventlog_application]
search = sourcetype=WinEventLog:Application index=os_windows OR index=test_application_index

Then in your search bar, do this:

eventtype=wineventlog_application | do_other_things_here

Re: How to forward Windows event log "application" to 2 different indexes?

KooroshFooladba — Mon, 28 Sep 2020 18:34:42 GMT

Thanks for the reply, please correct me if I am wrong,
by what you have mentioned I believe you are assuming that the wineventlog_application is already in both indexes which is not my case, my wineventlog_application is just in os_windows and I need to send it to test_application_index

Re: How to forward Windows event log "application" to 2 different indexes?

alacercogitatus — Tue, 06 Jan 2015 19:43:42 GMT

So then whereever that input "WinEventLog:Application" is being collected from, create a local/inputs.conf with this in it:

[WinEventLog:Application]
index = test_application_index

This will override the input and put it into the new index. You can't (and shouldn't) send it to both, so anything using os_windows will stop working.

Re: How to forward Windows event log "application" to 2 different indexes?

KooroshFooladba — Mon, 28 Sep 2020 18:34:48 GMT

Yes, I assumed that I should add this lines to the inputs.conf of those machine (windows machines) forwarding the logs, but my concern or question is by doing that aren't we indexing same data twice? indexing in os_windows by default and indexing in test_application_index which will cost us the license usage.

Thanks

Re: How to forward Windows event log "application" to 2 different indexes?

alacercogitatus — Tue, 06 Jan 2015 20:19:09 GMT

Nope, the config is overwritten - you won't see the same data in two different indexes unless you do some really fancy configurations. If you goto C:\Program Files\SplunkUniversalForwarder\bin, and run:

./splunk.exe cmd btool --debug inputs list WinEventLog:Application

You will see what values are set, and what file they come from.

Re: How to forward Windows event log "application" to 2 different indexes?

KooroshFooladba — Tue, 06 Jan 2015 20:25:05 GMT

Thanks,

I will try it today and will confirm tomorrow.

Re: How to forward Windows event log "application" to 2 different indexes?

riqbal — Mon, 21 May 2018 12:16:52 GMT

I have install UF on our central syslog server. that syslog server is getting logs from different network devices.
logs files are getting saved at /central/$devicename$
I wan to save logs under index = syslog_route index.