https://community.splunk.com/t5/Getting-Data-In/How-to-define-inputs-conf-for-selective-indexing-for-data-coming/m-p/443857#M77288 <P>I have a new data set being pushed via Splunk REST API. Because I am using selective indexing, I have some indexes stored locally, some don't. It's all set via <CODE>_INDEX_AND_FORWARD_ROUTING</CODE>.<BR /> However, it doesn't seem to work for this new data set coming in from the REST API. <BR /> Others are not via the REST API, and other data show up during the search. </P> <P>Here is what I put in as a new stanza in inputs.conf. </P> <PRE><CODE>[monitor:///opt/splunk/var/lib/splunk/new-ind/db] index = new-ind source = restAPI sourcetype = web_event _INDEX_AND_FORWARD_ROUTING = new-ind </CODE></PRE> <P>Any help will be appreciated. </P> Thu, 27 Jun 2019 15:41:54 GMT danthebiman 2019-06-27T15:41:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-define-inputs-conf-for-selective-indexing-for-data-coming/m-p/443857#M77288 <P>I have a new data set being pushed via Splunk REST API. Because I am using selective indexing, I have some indexes stored locally, some don't. It's all set via <CODE>_INDEX_AND_FORWARD_ROUTING</CODE>.<BR /> However, it doesn't seem to work for this new data set coming in from the REST API. <BR /> Others are not via the REST API, and other data show up during the search. </P> <P>Here is what I put in as a new stanza in inputs.conf. </P> <PRE><CODE>[monitor:///opt/splunk/var/lib/splunk/new-ind/db] index = new-ind source = restAPI sourcetype = web_event _INDEX_AND_FORWARD_ROUTING = new-ind </CODE></PRE> <P>Any help will be appreciated. </P> Thu, 27 Jun 2019 15:41:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-define-inputs-conf-for-selective-indexing-for-data-coming/m-p/443857#M77288 danthebiman 2019-06-27T15:41:54Z