topic Re: Index name entry in inputs.conf in Getting Data In

Index name entry in inputs.conf

kannu — Wed, 11 Jul 2018 15:29:49 GMT

Hello splunkers ,

I have seen in system/local/inputs.conf of many servers that it contains one entry provided below

root@abchost:~ # cat /opt/splunkforwarder/etc/system/local/inputs.conf

[default]
host  = abc.com
index = unmanaged

What is need of providing index= unmanged in that .

I am just simply guessing that might be it provided the default index entry to those monitors which don't have index name specified ,

Please let me know if i am right or wrong , if wrong then please let me know what is the need of providing that value .

Re: Index name entry in inputs.conf

kmorris_splunk — Wed, 11 Jul 2018 15:37:41 GMT

Use the [default] stanza to define any global settings.
* You can also define global settings outside of any stanza, at the top of
the file.
* Each conf file should have at most one default stanza. If there are
multiple default stanzas, settings are combined. In the case of
multiple definitions of the same setting, the last definition in the
file wins.
* If an setting is defined at both the global level and in a specific
stanza, the value in the specific stanza takes precedence.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Inputsconf

Re: Index name entry in inputs.conf

kannu — Wed, 11 Jul 2018 16:15:58 GMT

@kmorris [Splunk]

That i know but question here is what is the use of index = unmanaged

Re: Index name entry in inputs.conf

woodcock — Wed, 11 Jul 2018 17:36:58 GMT

I think that your guess is probably correct, based on the name of the index. Unless you can talk to the person who created that stanza or the person who created that index (he might have left some comments in the inputs.conf or indexes.conf file so check that), there will be no way to know for sure.

Re: Index name entry in inputs.conf

kannu — Thu, 12 Jul 2018 12:04:25 GMT

@woodcock

This entry came pre-loaded . when i have installed splunk forwarder on linux host .

Re: Index name entry in inputs.conf

FrankVl — Thu, 12 Jul 2018 12:26:37 GMT

Which forwarder version is that? And how are you installing it? Because last time I installed a UF from a tgz (v7.1.1), it definitely didn't contain that setting by default.

Re: Index name entry in inputs.conf

woodcock — Thu, 12 Jul 2018 14:25:13 GMT

I think probably not. But maybe your installation process connected your forwarder to a Deployment Server and it pulled the setting in that way.

Re: Index name entry in inputs.conf

FrankVl — Thu, 12 Jul 2018 14:28:04 GMT

Can a deployment server influence etc/system/local?