Getting Data In

Change File/Directory Input Index

bteele
New Member

In our distributed environment, we've got our File/Directory data inputs configured on our deployment server, and our production indexes on our indexer. The indexes aren't replicating between the two.

When I add a new File/Directory data input, I can choose an index, but only those local to the deployment server. The index I want to use, on the Indexer, isn't available in the dropdown.

How can I change that index? I've looked for a config file on either server, but can't find anything to manually configure.

Tags (1)
0 Karma

p_gurav
Champion

If you have indexer clusetring , you need to put indexes.conf on master node in "$SPLUNK_HOME/etc/master-apps//local".

If you don't have clustering then you can create one index on deployment server, but while doing file and directory monitoring make sure you are doing it in forwarded input not in local input.

Below docs may help:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Forwarddata

0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...