topic Re: Which index does the forwarded data go??? in Getting Data In

Which index does the forwarded data go???

Caio_Santos — Wed, 15 Sep 2010 01:41:43 GMT

How do I know which index forwarded data goes to receiver instance ? I'm not sure about that, but i've created 2 index. One on the forwarder other on the receiver instance and here is the trick, both with the same name and I guess it might be working because the index on the receiver is increasing.

how can i make sure about that ??? and is there any way to set this up if is not correct ??

Re: Which index does the forwarded data go???

dwaddle — Wed, 15 Sep 2010 01:50:06 GMT

You don't need to create indexes on forwarder nodes. Indexes only need to be created at the indexer. A forwarder can influence which index forwarded data goes into at the indexer via inputs.conf, similar to as follows:

[monitor:///my/log/file.txt]
index=myindex

But, this index must exist at the indexer, or the data will fall into /dev/null

Typically the light forwarder configuration disables all local indexes, through $SPLUNK_HOME/etc/apps/SplunkLightForwarder/default/indexes.conf.

Re: Which index does the forwarded data go???

Caio_Santos — Wed, 15 Sep 2010 02:27:04 GMT

I'm sorry for my ignorance dwaddle, but where can I find this file ??
Thank you very much