Deployment Architecture

Change Universal forwarder metrics from _internal index to another index possible?

hethu
Path Finder

Hi,

I want to monitor a whole bunch of Universal Forwarders that i have set up and configured. All data from these are all forwarded to a heavy forwarder that forwards everything to Splunk Cloud.

My problem is that i have only access to one index in the cloud, but not the _internal index that receives UF metrics. Is it possible to change the index from _internal to the one I have access to in the UF config?

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

While, in theory, it may be possible to have the data go to a different index, I advise against it.  First, some of the references to _internal may be hardcoded so you won't be able to change 100% of the events. Second, making such a change may have side effects such as built-in dashboards and alerts no longer working.  Finally, data written to _internal is free whereas sending to a different index will count against your license.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...