We are trying to set up to log container logs into Splunk 6.6.3.
We have set up an index and an application with an inputs.conf file and successfully updated the Splunk forwarder with the information inside the container. However, when we see the files coming in, they appear to be ignoring the app settings that includes our index and instead are sending the ingested logs to the main index.
How do I redirect them to the correct index (not the main index)?
You can also override your index on heavy forwarder of indexer `
On your indexer or heavy forwarder:
REGEX = .
FORMAT = my_new_index
TRANSFORMS-index = overrideindex`
also route your data https://answers.splunk.com/answers/1026/route-data-to-index-based-on-host.html.
Let me know if this helps
@nls7010, Is your inputs.conf in app is being considered while forwarding? Suggest to check the file precedence. Try running a
btool on inputs and see which configuration is considered for your log files