All Apps and Add-ons

How to change what index SEP logs get set to?

TheSplunkDude
Explorer

By Default all the SEP logs are going to the main index, how do I change this so it would go to a custom "SEP" index?

0 Karma
1 Solution

rpille_splunk
Splunk Employee
Splunk Employee

If you are using the conf files for configuration, try adding index = SEP to each stanza.

If you are configuring on a node that has a Splunk Web UI, you can select an index on the Input Settings screen as you go through the GUI steps to define each file monitor input.

View solution in original post

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

If you are using the conf files for configuration, try adding index = SEP to each stanza.

If you are configuring on a node that has a Splunk Web UI, you can select an index on the Input Settings screen as you go through the GUI steps to define each file monitor input.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!