topic Re: Renaming index for data coming from universal forwarder in Getting Data In

Renaming index for data coming from universal forwarder

nawazns5038 — Mon, 16 Jul 2018 18:39:40 GMT

We have data coming from lots of universal forwarders and it has various sources and sourcetypes and sending data only to a single index.
we don't have access to inputs.conf.
How can we redirect the data to a different index.
Can we use transforms.conf to work on that particular index (i,e changing index name for data based only on existing index )

Re: Renaming index for data coming from universal forwarder

niketn — Mon, 16 Jul 2018 18:50:36 GMT

@nawazns5038, what do you mean by not having access to inputs.conf. How will you have access to props.conf and transforms.conf otherwise?

Ideally, you should send the data to correct index using inputs.conf (pushed to UF through a deployment server). However, on Indexer or HF, you can route data to specific index based on regular expression matches. Please refer to the following documentation:

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes#Route_specific_events_to_a_different_index

Re: Renaming index for data coming from universal forwarder

nawazns5038 — Mon, 16 Jul 2018 19:51:01 GMT

Hi @niketnilay ,

The inputs.conf belongs to other customers. we have access to our own indexers. we don't use deployment server as they have huge number of hosts.
Thanks for the link. helpful !!