topic Re: Forwarder data going to main index in Getting Data In

Forwarder data going to main index

m314219 — Sat, 03 Jun 2017 14:09:45 GMT

I setup the Universal Forwarder on several Windows servers and pointed it towards my Splunk instance.

After installing the forwarder, I went to Splunk web > Add Data > Forward > Event Logs and selected the 'WindowsServer' server class that I had setup and selected my index called 'windows'.

However, despite the 'windows' index being set, all of the data coming from my universal forwarders is going into my 'main' index.

How can I correct this?

Re: Forwarder data going to main index

ddrillic — Sun, 04 Jun 2017 17:09:40 GMT

A similar issue at Why my data go in the wrong Index ?

Re: Forwarder data going to main index

rphillips_splk — Sun, 04 Jun 2017 19:03:31 GMT

@m314219 can you run the following from cli on your forwarder and attach the results, pointing out which input is in question.

from $SPLUNK_HOME\bin

.\splunk btool inputs list --debug > inputs.txt

Re: Forwarder data going to main index

rphillips_splk — Sun, 04 Jun 2017 19:20:15 GMT

@m314219 The btool output on inputs.conf will show your configured inputs. If there is no 'index=' attribute defined, then the events will go to the default index 'main'. You can edit inputs.conf directly such as:

inputs.conf (forwarder)

[WinEventLog://<name>]
index = windows

restart splunk after making the config change

note: make sure you've configured the 'windows' index on the indexers in indexes.conf