topic how route data to specific index when we use heavy forwarder? in Getting Data In

how route data to specific index when we use heavy forwarder?

manikanta66 — Sun, 26 Nov 2017 10:40:57 GMT

I build distributed Splunk Enterprise network the network flow is like below
UF--->HF------->IDX----->SH
In which I monitor a log file using inputs.conf
[monitor:///var/log/syslog] disabled = false index = new_indexer

I also created a new index in Indexer

But the log files are not indexing in indexer.

if I remove the index stanza in inputs.conf file the data is now indexing on the indexer.

Now here my question
How I specify the index to route the data to specific index?

Re: how route data to specific index when we use heavy forwarder?

jkat54 — Sun, 26 Nov 2017 13:40:24 GMT

What is the index name on the indexer? Is that the name you’re using in inputs.conf?

Re: how route data to specific index when we use heavy forwarder?

jkat54 — Sun, 26 Nov 2017 13:40:24 GMT

What is the index name on the indexer? Is that the name you’re using in inputs.conf?

Re: how route data to specific index when we use heavy forwarder?

esix_splunk — Sun, 26 Nov 2017 14:39:51 GMT

Validate that your index name is new_indexer and not new_index.

Otherwise, you need to switch those configurations, and change the inputs to be new_index on the UF where you have the inputs.conf.

Re: how route data to specific index when we use heavy forwarder?

woodcock — Sun, 26 Nov 2017 23:51:06 GMT

You need to put your monitor stanza on the UF node and then make sure that it has index=new_index_not_new_indexer. Then make sure that that same UF has an outputs.conf file that points to your indexer tier (OR to your HF tier but preferably not to HF as you probably should not be using an HF tier anyway). Then restart Splunk on your UF to start sending in. Your problem is probably that you are confusing index (the name of the DB where you data buckets are stored) and indexer (the server that has it's own subset of all the index data). There is no indexer setting in inputs.conf, only index settings. Similarly, there is no index setting in outputs.conf, only indexer settings.