topic Data going to wrong index in Splunk Search

Data going to wrong index

yasarforu — Tue, 15 Jul 2014 10:10:48 GMT

I configured my log file path to my specific index. But after indexing i found the data going into main index. I tried by giving [default]index= xys, index with [monitor://
but no luck so far.

Any suggestion on this?

Re: Data going to wrong index

Ayn — Tue, 15 Jul 2014 11:19:48 GMT

If you specify index=someindex in your monitor section in inputs.conf, that will change which index the data is sent to unless you have some transform changing that at a later stage.

Re: Data going to wrong index

strive — Tue, 15 Jul 2014 16:21:32 GMT

Can you post your inputs.conf and also transforms.conf

Re: Data going to wrong index

yasarforu — Wed, 16 Jul 2014 06:51:53 GMT

Tried 1:
[default]
index=sfs

[monitor:///web/logs/sfs/GCTIRServices*]
disabled=false

Tried 2:
[default]
index=sfs

[monitor:///web/logs/sfs/GCTIRServices*]
disabled=false
index=sfs

Tried 3:
[monitor:///web/logs/sfs/GCTIRServices*]
disabled=false
index=sfs

I tried all above 3 options before posting this question. It is still going to main index.