Archive

Multiple Networks, Multiple Indexes, and One Splunk server

Path Finder

Hello,

I would like to get your opinion on how to best deploy a Splunk configuration.

I have three networks all coming into Splunk. Network X, Network Y, and Network Z. Each network is forwarding logs via the Universal Forwarder into Splunk.

I would like to create separate indexes for each network, so I can perform searches for each specific network, and build a dashboards for each network.

For example,

index:company_x "EventCode=675"

or

index:company_y "EventCode=675"

I would also like to do this for all logs coming into Splunk from those specific networks. For example, OSSEC, and IIS.

Thank you

0 Karma
1 Solution

Legend

Go to each universal forwarder and find all of the inputs.conf files. Skip any file that is located in a default directory. Edit the inputs.conf files in local directories, and place the following line in each stanza:

index=companyXYZ

(whichever index is appropriate for each input.)

Possible alternative:

I think you might be able to do it this way, which would be simpler, but I can't test it for you...
Go to each universal forwarder and edit the $SPLUNK_HOME/etc/system/local/inputs.conf file, adding this to the top of the file:

[default]
index=companyXYZ

This should then apply to all inputs from that forwarder, unless an input explicitly specifies a different index.

Remember that these changes will only apply to new data. Existing data will not be changed.

View solution in original post

Legend

Go to each universal forwarder and find all of the inputs.conf files. Skip any file that is located in a default directory. Edit the inputs.conf files in local directories, and place the following line in each stanza:

index=companyXYZ

(whichever index is appropriate for each input.)

Possible alternative:

I think you might be able to do it this way, which would be simpler, but I can't test it for you...
Go to each universal forwarder and edit the $SPLUNK_HOME/etc/system/local/inputs.conf file, adding this to the top of the file:

[default]
index=companyXYZ

This should then apply to all inputs from that forwarder, unless an input explicitly specifies a different index.

Remember that these changes will only apply to new data. Existing data will not be changed.

View solution in original post

Path Finder

[default]
index=companyXYZ

worked just fine!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!