topic Re: Index main in Getting Data In

Index main

juls0125 — Wed, 08 Jan 2020 14:43:29 GMT

Hello Splunkers!

I have a question, i have installed a universal forwarder on a AIX server, but all the logs arrives on the index "main", they should be arrive in one especific index that i created. How can i fix this issue and why is this happening?

Re: Index main

richgalloway — Wed, 08 Jan 2020 15:19:20 GMT

Check the inputs.conf file(s) on the forwarder to confirm an index is specified for each input.

Re: Index main

juls0125 — Wed, 08 Jan 2020 19:15:48 GMT

i have added the next information on the inputs.conf file without any change (informix is the index)

[monitor://$SPLUNK_HOME/audit]
index = informix

Re: Index main

richgalloway — Fri, 10 Jan 2020 13:16:19 GMT

Did you restart Splunk after making the change?