Forwarder data going to main index

[m314219]

I setup the Universal Forwarder on several Windows servers and pointed it towards my Splunk instance.

After installing the forwarder, I went to Splunk web > Add Data > Forward > Event Logs and selected the 'WindowsServer' server class that I had setup and selected my index called 'windows'.

However, despite the 'windows' index being set, all of the data coming from my universal forwarders is going into my 'main' index.

How can I correct this?

[rphillips_splk]

@m314219 The btool output on inputs.conf will show your configured inputs. If there is no 'index=' attribute defined, then the events will go to the default index 'main'. You can edit inputs.conf directly such as:

inputs.conf (forwarder)

[WinEventLog://<name>]
index = windows

restart splunk after making the config change

note: make sure you've configured the 'windows' index on the indexers in indexes.conf

[ddrillic]

A similar issue at Why my data go in the wrong Index ?

[rphillips_splk]

@m314219 can you run the following from cli on your forwarder and attach the results, pointing out which input is in question.

from $SPLUNK_HOME\bin

.\splunk btool inputs list --debug > inputs.txt