topic Forwarding events to different indexes in Getting Data In

Forwarding events to different indexes

krugger — Mon, 11 Feb 2013 11:15:01 GMT

Hi,

I have a universal forwarder that is monitoring a couple of text log files on a AD server. Now I would like to have the universal forwarder also monitor the windows event logs. So I currently have the following config in the input.conf;

[monitor://E:\App\serverlog.txt]
disabled = false 
index=appserver

I have read through the manual and I am going to add:

[WinEventLog:Application]
disabled = 0 
[WinEventLog:Security]
disabled = 0 
[WinEventLog:System]
disabled = 0 

[WinEventLog:DNS Server]
disabled = 0
[WinEventLog:Directory Service]
disabled = 0
[WinEventLog:File Replication Service]
disabled = 0

However I would like to have the logs from the AD in their own indexes and not all mixed up with the appserver index. I have installed the Splunk for AD addon.

Should I just add a index=adlog or something like that to the input.conf at the universal forwarder? Does the Splunk for AD split the logs to their own index automatically?

Re: Forwarding events to different indexes

stefano_guidoba — Mon, 11 Feb 2013 15:10:31 GMT

Hi krugger,

you just need to add to every stanza in your inputs.conf file the index you prefer.
So, taking your example:

[WinEventLog:Application]
disabled=0
index=adlog

This way, splunk will index that data undex adlog index. Also, I suggest to diversify your inputs assigning them different sourcetypes, specifying it in your inputs.conf under the "index" entry.
Regards,

Stefano

Re: Forwarding events to different indexes

kristian_kolb — Mon, 11 Feb 2013 16:42:20 GMT

Do not forget to create the index on the indexer. Splunk will not create it for you automatically. Basic configuration of indexes can be done from the manager.

Also, you do not need to assign sourcetypes for windows event logs, as they will automatically get the source and sourcetype set to WinEventLog:XXXXX for each value of XXXXX, in the monitor stanzas.