topic Inputs not routing to correct index in Getting Data In

Inputs not routing to correct index

rmcdougal — Tue, 24 Apr 2012 22:35:25 GMT

I have data being sent in by universal forwarders on port 9908 that I would like put into a custom index. This is how I have my C:\Program Files\Splunk\etc\system\local\inputs.conf setup.

[splunktcp://9908] index = pc

However, the data from those universal forwarders is getting indexed into the "main" index. Any ideas why it is ignoring my index selection.

Re: Inputs not routing to correct index

Damien_Dallimor — Tue, 24 Apr 2012 23:27:53 GMT

The splunktcp input is for receiving "cooked" data (vs a raw TCP data input), so try specifying the "index" in the Universal Forwarder's inputs.conf instead.

If you do need to set the meta fields (index, sourcetype, source etc..) on the Receiver side using splunktcp , it is best to do this with index time field transforms using props.conf and transforms.conf