topic Re: configured sources for index in inputs.conf in Getting Data In

configured sources for index in inputs.conf

charyjpmc — Thu, 01 Mar 2018 07:28:11 GMT

Hi All,

I would like to get all the source files configured(in inputs.conf) to particular index. Whether the source is reporting to the index or not, I want to see the values index wise.

Thanks in advance.

Re: configured sources for index in inputs.conf

gcusello — Tue, 29 Sep 2020 18:17:04 GMT

Hi charyjpmc,
I'm not sure to understand your need: do you want to send all the inputs in one index?

To do this you have to insert in every room of your inputs.conf

index=my_index

If instead you don't want to insert this option in every room of inputs.conf, you can configure your Indexers to override index value.
To do this, you have to insert in every Indexers or heavy forwarder:
in your props.conf

 [mysourcetype]
 TRANSFORMS-index = overrideindex

in your transforms.conf

 [overrideindex]
 DEST_KEY =_MetaData:Index
 REGEX = .
 FORMAT = my_new_index

In this way, every event with sourcetype=mysourcetype will be sent to my_new_index.

Bye.
Giuseppe

Re: configured sources for index in inputs.conf

FrankVl — Thu, 01 Mar 2018 13:08:46 GMT

If you want to get an overview of which inputs are configured to go to which index, I guess you could get that using the btool command:
http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurations

For example: ./splunk cmd btool inputs list

Re: configured sources for index in inputs.conf

deepashri_123 — Mon, 05 Mar 2018 10:08:47 GMT

Hey charyjpmc,

You can run the following query:
| metadata type=sources index=yourindex

Hope this helps!!!

Re: configured sources for index in inputs.conf

charyjpmc — Fri, 16 Mar 2018 08:38:48 GMT

Thanks for reply ..

This query will help me to all the sources but if we have any rolling logs then it bring all those too..
I want only configured logs in inputs.conf file.