Deployment Architecture

Configure a new default index on universal forwarder

robinpilch
New Member

I'm currently using a Universal forwarder to forward log data out to a Splunk cloud deployment from internal forwarders, is it possible to configure a custom index on this forwarder so all data goes to the custom index without having to make the change on all internal forwarders?

Tags (1)
0 Karma

FrankVl
Ultra Champion

No, a Universal Forwarder acting as an intermediate forwarder will not be able to route data to another index. It will just pass it along as it received it from the original forwarders.

You will need to configure this either on the original forwarders (which should be fairly straightforward if you manage those with a deployment server), or use a Heavy Forwarder as intermediate, which you then configure with props and transforms to override the index metadata field. Note: the HF solution only works if the original forwarders are UF. For any original forwarder being a HF the config would need to be on that original HF. In general: such configuration needs to be on the first Splunk Enterprise instance that touches the data, so either the first HF, or if no HFs in the path (only UF), then on the Indexer(s).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...