topic how do i segregate data from one splunk forwarder in a seperate index? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/how-do-i-segregate-data-from-one-splunk-forwarder-in-a-seperate/m-p/12119#M825 <P>I have one splunk forwarder I need to segregate from other indexes. I have created its own index and I need to know how to get the data from the splunk forwarder into it. I only have one port open for lightweight forwarding.</P> <P>Is this possible through props.conf and transforms.conf or do I need to do something different</P> Fri, 23 Apr 2010 06:44:24 GMT Alan_Bradley 2010-04-23T06:44:24Z how do i segregate data from one splunk forwarder in a seperate index? https://community.splunk.com/t5/Getting-Data-In/how-do-i-segregate-data-from-one-splunk-forwarder-in-a-seperate/m-p/12119#M825 <P>I have one splunk forwarder I need to segregate from other indexes. I have created its own index and I need to know how to get the data from the splunk forwarder into it. I only have one port open for lightweight forwarding.</P> <P>Is this possible through props.conf and transforms.conf or do I need to do something different</P> Fri, 23 Apr 2010 06:44:24 GMT https://community.splunk.com/t5/Getting-Data-In/how-do-i-segregate-data-from-one-splunk-forwarder-in-a-seperate/m-p/12119#M825 Alan_Bradley 2010-04-23T06:44:24Z Re: how do i segregate data from one splunk forwarder in a seperate index? https://community.splunk.com/t5/Getting-Data-In/how-do-i-segregate-data-from-one-splunk-forwarder-in-a-seperate/m-p/12120#M826 <P>Just set </P> <PRE><CODE> index = specialindex </CODE></PRE> <P>either under each input on that forwarder in <CODE>inputs.conf</CODE>, or set it at the top of the <CODE>inputs.conf</CODE> file and it will be defaulted for all inputs unless otherwise specified (though note that some UI-configured inputs will set <CODE>index = default</CODE>)</P> Fri, 23 Apr 2010 07:59:40 GMT https://community.splunk.com/t5/Getting-Data-In/how-do-i-segregate-data-from-one-splunk-forwarder-in-a-seperate/m-p/12120#M826 gkanapathy 2010-04-23T07:59:40Z Re: how do i segregate data from one splunk forwarder in a seperate index? https://community.splunk.com/t5/Getting-Data-In/how-do-i-segregate-data-from-one-splunk-forwarder-in-a-seperate/m-p/12121#M827 <P>It's possible to do with a transform, but the input method gkanapthy is suggesting is easier and simpler.</P> Fri, 23 Apr 2010 15:04:26 GMT https://community.splunk.com/t5/Getting-Data-In/how-do-i-segregate-data-from-one-splunk-forwarder-in-a-seperate/m-p/12121#M827 jrodman 2010-04-23T15:04:26Z