Getting Data In

Change Index name of some data from HEC

karthikm
Loves-to-Learn Everything

I have a HEC token sending various logs from AWS Cloudwatch. HEC token is set to have two indexes paloalto and aws.

And all the data is going to the default index aws.

I want all the data from the source=syslogng to be sent to index=paloalto instead of index=aws.

Should I change the inputs.conf or props.conf for the splunk_httpinput in the deployment apps?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If you have a HEC input, you can define which indexes the input is limited to. But if you want other index than the default one, the source sending events must specify it.

Otherwise you have to overwrite metadata later duing ingestion phase https://docs.splunk.com/Documentation/Splunk/9.1.0/Forwarding/Routeandfilterdatad

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...