Change indexer

[toporagno]

i need to change  a indexer for a data send by a universal forward, i've this data source_type="pippo" with sourcetype:"paperino" and index="pluto" so i need to send all of this data in another index like index="nino"

i try with a props.conf and transforms.conf but it doesn't work

[toporagno]

Can you write me an practive example?

please

[gcusello]

Hi @toporagno,

Icould be more detailed if you share your inputs.conf in the forwarder.

anyway, you should have somethig like this:

[monitor://C:\my_directory\my_file.log]
index=my_index
sourcetype=my_sourcetype
disabled=0

As I said, if you have few Universal Forwarders, you can manually modify all the inputs.conf, if they are many, you should think to use a Deployment Server, but this is another project.

For more infos about DS, you can see at https://docs.splunk.com/Documentation/Splunk/9.1.2/Updating/Aboutdeploymentserver

Ciao.

Giuseppe

[gcusello]

Hi @toporagno,

At first how are you taking these logs: from a Universal Forwarder or from an Heavy Forwarder or another Splunk server?

if you are using a UF, I suppose that you are using a Deployment Server to manage it, so in the inputs.conf, you could add the sourcetype and the index.

IOf instead you are receiving a syslog in an HF, you have to apply the same update to the related inputs.conf.

You could alse override the index and sourcetype on the Indexer, or (if present) on the HF, but it's easier modifying the inputs.conf.

Ciao.

Giuseppe

[toporagno]

i use a UF

[gcusello]

Hi @toporagno ,

this means that you have to manually or by Deployment Server update your inputs.conf stanza in the Universal Forwarder, adding the lines for index and sourcetype.

Ciao.

Giuseppe