https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-and-a-New-Index/m-p/27963#M4748 <P>For the few Windows servers I am collecting data, none of it is from the Windows logs; only the application that runs on these servers. However, the UF gets its instructions from what to monitor from inputs.conf, so there is one defined on your server -- perhaps as a result of the MSI install process -- that has set this up. In that file is a line that reads "index={INDEX_NAME}". The file you want for your purpose is likely in the etc/system/local directory on the server with the UF installed. Check that out, it probably says "index=main" or "index=default" and you can edit that to read "index=dc_logs". Naturally, the UF will need restarted after this change is saved.</P> Tue, 07 Aug 2012 18:44:46 GMT rgcurry 2012-08-07T18:44:46Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-and-a-New-Index/m-p/27962#M4747 <P>Firstly I'm new to splunk and a bit confused.<BR /> One question I would like answered first is can you use new indexes in the free version and have a Universal Forwarder send data to it?</P> <P>If so then can someone give me help/guidance/instructions on how to achieve the following:<BR /> At the moment in a test environment I have a 2008 R2 server setup as a Domain Controller and want to save the security logs, the Universal Forwarder is installed on this server and using port 9997.<BR /> On another server I have the full(free) version of Splunk-4.3.3 installed.<BR /> I created a new index called dc_logs and setup the Receiver.<BR /> The info from the DC is coming across but into the Main default index and I cannot seem to work out how to set it so the data goes into the dc_logs index.<BR /> The ultimate goal is get the security logs into an individual index and retain the info for a period of 6 months.</P> Mon, 28 Sep 2020 12:12:46 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-and-a-New-Index/m-p/27962#M4747 alertsuser 2020-09-28T12:12:46Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-and-a-New-Index/m-p/27963#M4748 <P>For the few Windows servers I am collecting data, none of it is from the Windows logs; only the application that runs on these servers. However, the UF gets its instructions from what to monitor from inputs.conf, so there is one defined on your server -- perhaps as a result of the MSI install process -- that has set this up. In that file is a line that reads "index={INDEX_NAME}". The file you want for your purpose is likely in the etc/system/local directory on the server with the UF installed. Check that out, it probably says "index=main" or "index=default" and you can edit that to read "index=dc_logs". Naturally, the UF will need restarted after this change is saved.</P> Tue, 07 Aug 2012 18:44:46 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-and-a-New-Index/m-p/27963#M4748 rgcurry 2012-08-07T18:44:46Z