Archive
Highlighted

Change the index name of Splunk_CiscoFirewalls

Path Finder

instead of storing the cisco firewall logs into "summary" index. i would like to store in a index called "firewall".

other than creating the index "firewall", and adding index = firewall into the local/inputs.conf, what else must i do?

Tags (1)
0 Karma
Highlighted

Re: Change the index name of Splunk_CiscoFirewalls

Splunk Employee
Splunk Employee

Changing the inputs is a good start.

If some data are generated using summary searches, then you need also to check the destination index of the summary. (default is summary). see in savedsearches.conf

0 Karma