topic Re: Data going to main even after set to different index in Getting Data In

Data going to main even after set to different index

johnlzy0408 — Fri, 29 Jan 2021 09:47:13 GMT

Hi all,

I have install splunk forwarder in 1 centos device, sending to indexer.

From the search head, i can see data from this host but the the index is put as Main.

On the app, we have already specify to another index and we verified that the index is created.

Anybody know what am i missing? Already restart splunk services for both host and searchhead.

Re: Data going to main even after set to different index

richgalloway — Fri, 29 Jan 2021 14:02:25 GMT

Double-check the query and settings. The btool output shown is for source /var/log/messages, but the query is showing source=/var/log/cron.

Re: Data going to main even after set to different index

johnlzy0408 — Fri, 29 Jan 2021 14:36:35 GMT

Yea i know, I am just showing an example.

This is the actual settings.

This is the settings in the inputs.conf. Strangely, this is set to disabled but we are receiving from this source.

Re: Data going to main even after set to different index

johnlzy0408 — Fri, 29 Jan 2021 14:40:08 GMT

I mean for the /var/log/cron. And strangely, all my /var/logs/messages path are also not sending since this morning. i do not know what i did

Re: Data going to main even after set to different index

richgalloway — Fri, 29 Jan 2021 16:03:03 GMT

If you're receiving data for a disabled input then the inputs.conf either has not been loaded (restart the forwarder) or is overridden by another inputs.conf file (btool should show that). The same goes for data being sent to the wrong index.