Deployment Architecture

How do I redirect logs from the default main index to a new index?

Path Finder

We are trying to set up to log container logs into Splunk 6.6.3.

We have set up an index and an application with an inputs.conf file and successfully updated the Splunk forwarder with the information inside the container. However, when we see the files coming in, they appear to be ignoring the app settings that includes our index and instead are sending the ingested logs to the main index.

How do I redirect them to the correct index (not the main index)?

0 Karma

Path Finder

Question. What belongs in the [mysourcetype] in the props.conf? Is it looking for a sourcetype value?

0 Karma


You can also override your index on heavy forwarder of indexer `

On your indexer or heavy forwarder:

# etc/system/local/transforms.conf
DEST_KEY =_MetaData:Index
FORMAT = my_new_index

TRANSFORMS-index = overrideindex`

also route your data

Let me know if this helps

0 Karma

Path Finder

I will work with my client and let you know if the redirection will work. Thank you for your reply.

0 Karma


@nls7010, Is your inputs.conf in app is being considered while forwarding? Suggest to check the file precedence. Try running a btool on inputs and see which configuration is considered for your log files

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...