All Apps and Add-ons

DUO Add-on: How do I specify an index that is not on the local instance

Path Finder

The modular input only lists indexes on the local Splunk instance. The heavy forwarder where the add-on is installed sends events to a cluster. How do I specify an index that is not one of the local indexes, i.e. whatever index name I want?

0 Karma
1 Solution

Path Finder

You can create the index on the heavyforwarder so the add-on sees it as an option, as long as the heavyforwarder is set to send everything to your indexers, the data will be forwarded and not indexed locally.

View solution in original post

0 Karma

Path Finder

You can create the index on the heavyforwarder so the add-on sees it as an option, as long as the heavyforwarder is set to send everything to your indexers, the data will be forwarded and not indexed locally.

View solution in original post

0 Karma

Path Finder

That solution occurred to me, but I don't like it. It would be better to have a text box instead of a drop down for the index name.

0 Karma

Path Finder

My temporary solution is to rewrite the index metadata. Thanks for the app!

props.conf

[duo:administrator]
TRANSFORMS-duo_administrator = duo_set_index
[duo:authentication]
TRANSFORMS-duo_authentication = duo_set_index
[duo:info_summary]
TRANSFORMS-duo_info_summary = duo_set_index
[duo:telephony]
TRANSFORMS-duo_telephony = duo_set_index

transforms.conf

[duo_set_index]
REGEX = .+
DEST_KEY = _MetaData:Index
FORMAT = some_index
0 Karma