https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-logs-from-network-gear-to-a-specific-index/m-p/387066#M95926 <P>If your HF is receiving the syslog data directly, look for an inputs.conf setting for udp:514 and add an <CODE>index=mynetworkindex</CODE> to it... ideally by running <CODE>splunk btool --debug inputs list udp</CODE></P> <P>If your HF's machine has a syslog daemon running that receives the data (better practice!), look for a monitor stanza in your HF's inputs.conf that reads the logs from the syslog daemon off disk, and set the network index in there.</P> Fri, 16 Nov 2018 17:10:58 GMT martin_mueller 2018-11-16T17:10:58Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-logs-from-network-gear-to-a-specific-index/m-p/387065#M95925 <P>I use Splunk on Windows. I have several heavy forwarders that forward Windows event logs to my indexer cluster into indexes named for the subnet where the Windows boxes reside. One such subnet has both Windows boxes and network gear. The Windows boxes send logs on port 9997 while the network gear sends on port 514 to the Heavy Forwarder. The logs from the Windows boxes show up in the appropriate index on the indexer cluster, but the network gear shows up in the <EM>Main</EM> index. </P> <P>How can I get the logs from the network gear to show up in the <EM>Network</EM> index from that heavy Forwarder? I believe that the solution lies in creations/modifications to the transforms.conf and props.conf files in splunkhome\etc\system\local folder. I appreciate any help. Thanks! </P> Fri, 16 Nov 2018 15:33:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-logs-from-network-gear-to-a-specific-index/m-p/387065#M95925 jmads 2018-11-16T15:33:18Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-logs-from-network-gear-to-a-specific-index/m-p/387066#M95926 <P>If your HF is receiving the syslog data directly, look for an inputs.conf setting for udp:514 and add an <CODE>index=mynetworkindex</CODE> to it... ideally by running <CODE>splunk btool --debug inputs list udp</CODE></P> <P>If your HF's machine has a syslog daemon running that receives the data (better practice!), look for a monitor stanza in your HF's inputs.conf that reads the logs from the syslog daemon off disk, and set the network index in there.</P> Fri, 16 Nov 2018 17:10:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-logs-from-network-gear-to-a-specific-index/m-p/387066#M95926 martin_mueller 2018-11-16T17:10:58Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-logs-from-network-gear-to-a-specific-index/m-p/387067#M95927 <P>Thanks, Martin! I have to unexpectedly leave work early today, but will give this a shot first thing Monday morning!</P> Fri, 16 Nov 2018 18:25:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-logs-from-network-gear-to-a-specific-index/m-p/387067#M95927 jmads 2018-11-16T18:25:44Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-logs-from-network-gear-to-a-specific-index/m-p/387068#M95928 <P>Martin, this worked like a champ! Thanks for the help!</P> Tue, 20 Nov 2018 11:52:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-logs-from-network-gear-to-a-specific-index/m-p/387068#M95928 jmads 2018-11-20T11:52:19Z