Deployment Architecture

Configure a new default index on universal forwarder

robinpilch
New Member

I'm currently using a Universal forwarder to forward log data out to a Splunk cloud deployment from internal forwarders, is it possible to configure a custom index on this forwarder so all data goes to the custom index without having to make the change on all internal forwarders?

Tags (1)
0 Karma

FrankVl
Ultra Champion

No, a Universal Forwarder acting as an intermediate forwarder will not be able to route data to another index. It will just pass it along as it received it from the original forwarders.

You will need to configure this either on the original forwarders (which should be fairly straightforward if you manage those with a deployment server), or use a Heavy Forwarder as intermediate, which you then configure with props and transforms to override the index metadata field. Note: the HF solution only works if the original forwarders are UF. For any original forwarder being a HF the config would need to be on that original HF. In general: such configuration needs to be on the first Splunk Enterprise instance that touches the data, so either the first HF, or if no HFs in the path (only UF), then on the Indexer(s).

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...