All Apps and Add-ons

Estreamer index goes into main how to change it...

New Member


By default if we do nothing eStreamer eNcore data and information goes directly into the main index

How can i change that in a cluster environnement.


0 Karma


I am not a splunk expert. I am sure there is a slicker / better way to do it but this works for me. I did this on my heavy forwarder that feeds an index cluster.

I copied this from

Where data is written to
disabled = 0
source = encore
sourcetype = cisco:estreamer:data
crcSalt =

I added this to /opt/splunk/etc/apps/TA-eStreamer/local/inputs.conf to overide the default
disabled = 0
source = encore
sourcetype = cisco:estreamer:data
crcSalt =
index = cisco

My cisco:estreamer:data is now going to index cisco instead of index main

Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...