All Apps and Add-ons

DUO Add-on: How do I specify an index that is not on the local instance

frankwayne
Path Finder

The modular input only lists indexes on the local Splunk instance. The heavy forwarder where the add-on is installed sends events to a cluster. How do I specify an index that is not one of the local indexes, i.e. whatever index name I want?

0 Karma
1 Solution

bawood
Path Finder

You can create the index on the heavyforwarder so the add-on sees it as an option, as long as the heavyforwarder is set to send everything to your indexers, the data will be forwarded and not indexed locally.

View solution in original post

0 Karma

bawood
Path Finder

You can create the index on the heavyforwarder so the add-on sees it as an option, as long as the heavyforwarder is set to send everything to your indexers, the data will be forwarded and not indexed locally.

0 Karma

frankwayne
Path Finder

That solution occurred to me, but I don't like it. It would be better to have a text box instead of a drop down for the index name.

0 Karma

frankwayne
Path Finder

My temporary solution is to rewrite the index metadata. Thanks for the app!

props.conf

[duo:administrator]
TRANSFORMS-duo_administrator = duo_set_index
[duo:authentication]
TRANSFORMS-duo_authentication = duo_set_index
[duo:info_summary]
TRANSFORMS-duo_info_summary = duo_set_index
[duo:telephony]
TRANSFORMS-duo_telephony = duo_set_index

transforms.conf

[duo_set_index]
REGEX = .+
DEST_KEY = _MetaData:Index
FORMAT = some_index
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more!  Faster Time to Value Managing and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...