Archive

Splunk default index issue

Explorer

Hello,

I am rolling out SPlunk across several Windows machines and have noticed a problem. To simplify installation of Splunk I have written a script which installs Splunk quietly from the command line. Next, the script stops the service, modifys the inputs.conf file adding the following line:

index=windows

Next the script starts the service. This appeared to be working correctly however I have now found that many events are being forwarded to the main index. I suspect that Splunk starts sending the events the moment it has been installed to the main index, after the service is stopped and the inputs.conf file is modified it begins sending to the correct index.

Firstly, how to I move the events that have already been forwarded into the correct index?

Second, and most important, how do I ensure that Splunk ONLY forwards events to the windows index?

Thanks.

Tags (1)
0 Karma

Legend

The index should be set for each of the stanzas in inputs.conf on each forwarder. You can't just set it once in the inputs.conf file.

You should set up all your configuration files on your forwarder before you start it for the first time. So you should install Splunk, set up the inputs, then start Splunk.

Finally, there is no way to move events from one index to another. The way to fix this is

  1. Stop splunk on the forwarders.
  2. If the forwarders are Universal Forwarders, remove the fishbucket. If the forwarders are light-weight forwarders, use the splunk clean command to remove all eventdata.
  3. Edit the inputs.conf on the forwarders, fixing the index=windows in every stanza. (There may be more than one inputs.conf on each forwarder. All of them may need to be fixed.)
  4. Stop the indexer(s). Clean all events from the main index and from the windows index.
  5. Build a staging environment, to test that your new setup and scripts will work!
  6. Restart the indexer(s).
  7. Restart the forwarders.

Your problem is a great example of why a staging environment can be really helpful to do a quick test of your setup before deployment.

Remove the fishbucket: http://splunk-base.splunk.com/answers/13591/re-send-data-with-universal-forwarder


Clean eventdata: http://www.splunk.com/base/Documentation/4.2.2/Admin/RemovedatafromSplunk