Hello,
I'm running an eval Splunk Enterprise (7.2.5, Build 088f49762779) in our lab and configuring Splunk Add-On for Windows (6.0.0) according to Splunk docs. I have the indexer setup and am deploying Splunk_TA_windows successfully to my DC and collecting enabled stanzas. It's pretty vanilla stuff setup from what I've read in Splunk documentation.
I'm playing around with custom indexes since everything is going to main as documented. I've created two custom indexes, "wineventlog" and "winad" in the indexes.conf located .\etc\system\local on the Splunk server.
[wineventlog]
homePath = $SPLUNK_DB/wineventlog/db
coldPath = $SPLUNK_DB/wineventlog/colddb
thawedPath = $SPLUNK_DB/wineventlog/thaweddb
maxDataSize = 10000
maxHotBuckets = 10
[winad]
homePath = $SPLUNK_DB/winad/db
coldPath = $SPLUNK_DB/winad/colddb
thawedPath = $SPLUNK_DB/winad/thaweddb
maxDataSize = 10000
maxHotBuckets = 10
I have changed the inputs.conf file for this app to point to the new indexes, but only the wineventlog is being used, the AD monitoring is still going to the main index. I have confirmed the client has received the new Inputs conf file, but I'm obviously missing or don't understand something. Any ideas?
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
index = wineventlog
renderXml=true
[monitor://$WINDIR\debug\netlogon.log]
sourcetype=MSAD:NT6:Netlogon
index = winad
disabled=0
[MonitorNoHandle://$WINDIR\System32\Dns\dns.log]
sourcetype=MSAD:NT6:DNS
index = winad
disabled=0
