https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarders-to-send-data-to-specific-index-on/m-p/185800#M37206 <P>The syntax of the statement in the stanza is index = domainname with spaces before and after the equal sign. There are no &lt; &gt; or " " around the name. The reference to &lt;domain&gt; is how Windows folks define a variable. </P> <P>It appears that the event logs and performance data are being indexed in main while the active directory data is being indexed in the domain specific index created on the indexer. </P> <P>This was an upgrade from 5.x to 6.2.2. The drive I have Splunk installed on only had 400 GB space. I have recently acquired 18 TB and am wanting to have the universal fowarders on the domain controllers log the data into indexes defined on the new drive. That way I can store more than say about a month of data before having to delete files. </P> Tue, 12 May 2015 14:45:04 GMT AndreaEClark 2015-05-12T14:45:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarders-to-send-data-to-specific-index-on/m-p/185797#M37203 <P>I'm running Splunk 6.2.2 on a Windows Platform. I have 3 Windows domains and would like to send wineventlog:security to indexes named for each of the domains. I installed the Universal Forwarder on all of the domain controllers and have configured index = &lt;domain&gt; in the default stanza of the inputs.conf. The indexer is a standalone Windows Server. When I query Splunk for index=domain, the only source type is Active Directory, not wineventlog:security. Is this a bug in the VERSION=6.2.2 BUILD=255606?</P> Mon, 11 May 2015 20:57:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarders-to-send-data-to-specific-index-on/m-p/185797#M37203 AndreaEClark 2015-05-11T20:57:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarders-to-send-data-to-specific-index-on/m-p/185798#M37204 <P>Check if the events are indexed under main. That way we know the data is coming through.</P> <P>There's also more locations that inputs.confs can reside. Look into the etc\apps\ directory. Most of my forwarders use the Splunk_TA_windows app for a lot of my windows log monitoring.</P> Mon, 28 Sep 2020 19:56:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarders-to-send-data-to-specific-index-on/m-p/185798#M37204 ConnorG 2020-09-28T19:56:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarders-to-send-data-to-specific-index-on/m-p/185799#M37205 <P>It this a typo or does your option for this inputs stanza really looks like index = &lt;domain&gt; ? <BR /> It should be <CODE>index = domain</CODE> instead.</P> Mon, 11 May 2015 21:42:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarders-to-send-data-to-specific-index-on/m-p/185799#M37205 MuS 2015-05-11T21:42:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarders-to-send-data-to-specific-index-on/m-p/185800#M37206 <P>The syntax of the statement in the stanza is index = domainname with spaces before and after the equal sign. There are no &lt; &gt; or " " around the name. The reference to &lt;domain&gt; is how Windows folks define a variable. </P> <P>It appears that the event logs and performance data are being indexed in main while the active directory data is being indexed in the domain specific index created on the indexer. </P> <P>This was an upgrade from 5.x to 6.2.2. The drive I have Splunk installed on only had 400 GB space. I have recently acquired 18 TB and am wanting to have the universal fowarders on the domain controllers log the data into indexes defined on the new drive. That way I can store more than say about a month of data before having to delete files. </P> Tue, 12 May 2015 14:45:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-forwarders-to-send-data-to-specific-index-on/m-p/185800#M37206 AndreaEClark 2015-05-12T14:45:04Z