https://community.splunk.com/t5/Getting-Data-In/Can-you-organizing-syslogs-into-different-indexes-via-universal/m-p/423836#M95306 <P>I have a tftp64 syslog service running on a windows box. Right now I have a few network appliances sending their syslogs to it. </P> <P>My question is, If I install the universal forwarder on the host and it connects via 999X to Splunk, is it possible to make splunk send the logs into specific indexes based on the appliance?</P> Tue, 23 Apr 2019 17:58:55 GMT summitsplunk 2019-04-23T17:58:55Z https://community.splunk.com/t5/Getting-Data-In/Can-you-organizing-syslogs-into-different-indexes-via-universal/m-p/423836#M95306 <P>I have a tftp64 syslog service running on a windows box. Right now I have a few network appliances sending their syslogs to it. </P> <P>My question is, If I install the universal forwarder on the host and it connects via 999X to Splunk, is it possible to make splunk send the logs into specific indexes based on the appliance?</P> Tue, 23 Apr 2019 17:58:55 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-organizing-syslogs-into-different-indexes-via-universal/m-p/423836#M95306 summitsplunk 2019-04-23T17:58:55Z https://community.splunk.com/t5/Getting-Data-In/Can-you-organizing-syslogs-into-different-indexes-via-universal/m-p/423837#M95307 <P>Do not syslog directly to splunk. Setup syslog-ng to write to files, then use Splunk UF with <CODE>monitor</CODE> stanzas, each of which can go to a different index:<BR /> <A href="http://www.georgestarcher.com/splunk-success-with-syslog/">http://www.georgestarcher.com/splunk-success-with-syslog/</A></P> Wed, 24 Apr 2019 01:06:58 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-organizing-syslogs-into-different-indexes-via-universal/m-p/423837#M95307 woodcock 2019-04-24T01:06:58Z