Indexing and forward not working when using custom named indexes

rishavvaidya — Mon, 04 Sep 2017 17:37:04 GMT

I have two standalone splunk servers for testing. On first instance, I'm trying index and forward.

Below is my inputs.conf and outputs.conf in server1
Inputs.conf>>>>
[root@localhost local]# cat inputs.conf
[monitor:///var/log/secure]
disabled = false
sourcetype = linux_secure
index = testing

And outputs.conf >>>>>
[tcpout]
defaultGroup = dataroute
indexAndForward = true
disabled = false

[tcpout:dataroute]
server = 192.168.75.139:9997

I have created testing indexes manually in both these splunk instances.

When I don't give any index then its working fine and I can see the data being forwarded to main index of 2nd instance but when I change the index to testing , it just doesn't work.
Help me figure out what I'm doing wrong.

Re: Indexing and forward not working when using custom named indexes

HiroshiSatoh — Tue, 05 Sep 2017 07:39:50 GMT

The index setting is bad.
Can you check from the setting screen?

Re: Indexing and forward not working when using custom named indexes

rishavvaidya — Tue, 05 Sep 2017 08:08:56 GMT

yes, moving the indexes.conf file to system/local solved the issue.

topic Re: Indexing and forward not working when using custom named indexes in Getting Data In

Indexing and forward not working when using custom named indexes

Re: Indexing and forward not working when using custom named indexes

Re: Indexing and forward not working when using custom named indexes