topic Re: Default index for all splunkforwarder monitors? in Getting Data In

Default index for all splunkforwarder monitors?

Jordan_Brough — Thu, 26 Apr 2012 13:44:36 GMT

I want all forwarders on a single splunkforwarder box to send data to the same specified index. I'd like to avoid having to do this in inputs.conf:

[monitor]
...
index=box_index

[monitor]
...
index=box_index

[monitor]
...
index=box_index

...

Is there a way to set the default index globally on a single box that functioning only as a splunkforwarder?

Re: Default index for all splunkforwarder monitors?

yannK — Thu, 26 Apr 2012 14:16:29 GMT

on every splunk instance the default destination index is defined in :
$SPLUNK_HOME/etc/system/default/inputs.conf
[default] index=default

on the indexers, the default index is specified in
$SPLUNK_HOME/etc/system/default/indexes.conf
#the global parameter (no stanza, just as first parameters of the file)
defaultDatabase = main

You can override it by adding in system/local on the forwarders (or in a deployed app)
$SPLUNK_HOME/etc/system/local/inputs.conf
[default] index=monitor

or on the indexers, change the default index to go to monitor, instead of main.
(but it will be the case for every events, not just for the forwarders)
add in local/indexes.conf
defaultDatabase = monitor

Re: Default index for all splunkforwarder monitors?

yannK — Thu, 26 Apr 2012 14:21:19 GMT

on every splunk instance the default destination index is defined in :
$SPLUNK_HOME/etc/system/default/inputs.conf
[default] index=default

on the indexers, the default index is specified in
$SPLUNK_HOME/etc/system/default/indexes.conf
#the global parameter (no stanza, just as first parameters of the file)
defaultDatabase = main

You can override it by adding in system/local on the forwarders
local/inputs.conf (in system or in a deployed app)
[default] index=monitor #was index-default

or on the indexers, change the default index to go to monitor, instead of main.
(but it will be the case for every events, not just for the forwarders)
add in local/indexes.conf (in system or in a deployed app)
defaultDatabase = monitor #was defaultDatabase = main

Re: Default index for all splunkforwarder monitors?

spunk311z — Tue, 11 Feb 2020 20:43:47 GMT

to be more clear, i want to add that in a deployed app (on a universal forwarderder), i to make this work on a input.conf i had to add it like this:

[default] 
index=xyz

Note the line break in my code block above, as on the inputs.conf adding it all as ONE LINE like this below:

[default] index=xyz

did not work / had effect. This was on a 6.6.x splunk setup / UF
tks