topic Re: Log keeps sending to index=main in Monitoring Splunk

Log keeps sending to index=main

splunktrainingu — Thu, 01 Oct 2020 23:00:50 GMT

Hello,

I been trying to figure this out for the past 2 days now and I cannot seem to find which config file is making my host send logs to index=main. I have 4 other machines in forward management that have the same application sending logs to the correct index except for this system. It seems to send Application logs to index=main but all other security logs go to index=windows. I double checked the apps folder on that machine and compared it with a machine that is not sending to index main and also did the same in the etc/system/local.

This is a single deployment we have a single search head and single indexer.

Re: Log keeps sending to index=main

renjith_nair — Fri, 02 Oct 2020 05:47:00 GMT

Try btool on the source machine to check whether any apps/local inputs.conf configured with index main

Reference : https://docs.splunk.com/Documentation/Splunk/8.0.6/Troubleshooting/Usebtooltotroubleshootconfigurations

Re: Log keeps sending to index=main

inventsekar — Fri, 02 Oct 2020 07:43:22 GMT

Hi @splunktrainingu ..
Q - I cannot seem to find which config file is making my host send logs to index=main.

Answers:
1. on the forwarder(s), you can run the btool command.

2. on the forwarder(s), you can view the inputs.conf file directly and see which log file is sending data to which index.

3. on splunk GUI, when you search for the logs from a host/forwarder, you can list down the source, sourcetype as well.
for example:

index=main host=UF-hostname | table source sourcetype index _raw _time

(PS - i have given around 500+ karma points so far, received badge for that, if an answer helped you, a karma point would be nice!. we all should start "Learn, Give Back, Have Fun")

Re: Log keeps sending to index=main

splunktrainingu — Fri, 02 Oct 2020 23:44:17 GMT

Thank you! from now on I am going to use this! It was so easy to see for some reason there was a inputs.conf in SplunkUniversalforwarder/etc/app/splunkuniversalforwarder/local/inputs.conf

I used the command

splunk btool inputs list --debug