Deployment Architecture

Multiple Networks, Multiple Indexes, and One Splunk server

MrWh1t3
Path Finder

Hello,

I would like to get your opinion on how to best deploy a Splunk configuration.

I have three networks all coming into Splunk. Network X, Network Y, and Network Z. Each network is forwarding logs via the Universal Forwarder into Splunk.

I would like to create separate indexes for each network, so I can perform searches for each specific network, and build a dashboards for each network.

For example,

index:company_x "EventCode=675"

or

index:company_y "EventCode=675"

I would also like to do this for all logs coming into Splunk from those specific networks. For example, OSSEC, and IIS.

Thank you

0 Karma
1 Solution

lguinn2
Legend

Go to each universal forwarder and find all of the inputs.conf files. Skip any file that is located in a default directory. Edit the inputs.conf files in local directories, and place the following line in each stanza:

index=companyXYZ

(whichever index is appropriate for each input.)

Possible alternative:

I think you might be able to do it this way, which would be simpler, but I can't test it for you...
Go to each universal forwarder and edit the $SPLUNK_HOME/etc/system/local/inputs.conf file, adding this to the top of the file:

[default]
index=companyXYZ

This should then apply to all inputs from that forwarder, unless an input explicitly specifies a different index.

Remember that these changes will only apply to new data. Existing data will not be changed.

View solution in original post

lguinn2
Legend

Go to each universal forwarder and find all of the inputs.conf files. Skip any file that is located in a default directory. Edit the inputs.conf files in local directories, and place the following line in each stanza:

index=companyXYZ

(whichever index is appropriate for each input.)

Possible alternative:

I think you might be able to do it this way, which would be simpler, but I can't test it for you...
Go to each universal forwarder and edit the $SPLUNK_HOME/etc/system/local/inputs.conf file, adding this to the top of the file:

[default]
index=companyXYZ

This should then apply to all inputs from that forwarder, unless an input explicitly specifies a different index.

Remember that these changes will only apply to new data. Existing data will not be changed.

MrWh1t3
Path Finder

[default]
index=companyXYZ

worked just fine!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...