Multiple Networks, Multiple Indexes, and One Splunk server

[MrWh1t3]

Hello,

I would like to get your opinion on how to best deploy a Splunk configuration.

I have three networks all coming into Splunk. Network X, Network Y, and Network Z. Each network is forwarding logs via the Universal Forwarder into Splunk.

I would like to create separate indexes for each network, so I can perform searches for each specific network, and build a dashboards for each network.

For example,

index:company_x "EventCode=675"

or

index:company_y "EventCode=675"

I would also like to do this for all logs coming into Splunk from those specific networks. For example, OSSEC, and IIS.

Thank you

[lguinn2 · Accepted solution]

Go to each universal forwarder and find all of the inputs.conf files. Skip any file that is located in a default directory. Edit the inputs.conf files in local directories, and place the following line in each stanza:

index=companyXYZ

(whichever index is appropriate for each input.)

Possible alternative:

I think you might be able to do it this way, which would be simpler, but I can't test it for you...
Go to each universal forwarder and edit the $SPLUNK_HOME/etc/system/local/inputs.conf file, adding this to the top of the file:

[default]
index=companyXYZ

This should then apply to all inputs from that forwarder, unless an input explicitly specifies a different index.

Remember that these changes will only apply to new data. Existing data will not be changed.

[MrWh1t3]

[default]
index=companyXYZ

worked just fine!