https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-multiple-indexes-in-a-single-server/m-p/437070#M76228 <P>We have a multiple logs in a single server. But, I want to separate those logs to control access. Can we send different log files to different indexes so that we can segrate the logs to users?</P> Fri, 14 Dec 2018 09:42:25 GMT bwniranjan 2018-12-14T09:42:25Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-multiple-indexes-in-a-single-server/m-p/437070#M76228 <P>We have a multiple logs in a single server. But, I want to separate those logs to control access. Can we send different log files to different indexes so that we can segrate the logs to users?</P> Fri, 14 Dec 2018 09:42:25 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-multiple-indexes-in-a-single-server/m-p/437070#M76228 bwniranjan 2018-12-14T09:42:25Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-multiple-indexes-in-a-single-server/m-p/437071#M76229 <P>@bwniranjan,<BR /> Yes of course! You can use multiple indexes in same indexer . </P> <P>Read though this documentation and let us know in case you have further questions.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/7.2.1/Indexer/Setupmultipleindexes">How to create multiple indexes</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.2.1/Data/Monitorfilesanddirectorieswithinputs.conf">Monitor files and directories with inputs.conf</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.2.1/Admin/Inputsconf#MONITOR:">Input conf for monitor</A></P> Fri, 14 Dec 2018 14:30:59 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-multiple-indexes-in-a-single-server/m-p/437071#M76229 renjith_nair 2018-12-14T14:30:59Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-multiple-indexes-in-a-single-server/m-p/437072#M76230 <P>If you have a universal forwarder installed on your host, yes-you can send those logs to different indexes...for instance you can have your inputs configured this way..</P> <PRE><CODE>inputs.conf [monitor:///var/log/httpd] sourcetype = access_common index = web_access [monitor:///var/log/messages] sourcetype = syslog index = linux_os </CODE></PRE> Fri, 14 Dec 2018 14:31:33 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-multiple-indexes-in-a-single-server/m-p/437072#M76230 prakash007 2018-12-14T14:31:33Z