Change File/Directory Input Index

bteele — Wed, 18 Apr 2018 17:15:42 GMT

In our distributed environment, we've got our File/Directory data inputs configured on our deployment server, and our production indexes on our indexer. The indexes aren't replicating between the two.

When I add a new File/Directory data input, I can choose an index, but only those local to the deployment server. The index I want to use, on the Indexer, isn't available in the dropdown.

How can I change that index? I've looked for a config file on either server, but can't find anything to manually configure.

Re: Change File/Directory Input Index

p_gurav — Thu, 19 Apr 2018 06:51:11 GMT

If you have indexer clusetring , you need to put indexes.conf on master node in "$SPLUNK_HOME/etc/master-apps//local".

If you don't have clustering then you can create one index on deployment server, but while doing file and directory monitoring make sure you are doing it in forwarded input not in local input.

Below docs may help:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Forwarddata

topic Re: Change File/Directory Input Index in Getting Data In

Change File/Directory Input Index

Re: Change File/Directory Input Index