Forwarder send Windows Events to different indexes

[insidious]

I have a universal forwarder pointed to the indexer cluster which sends Windows event logs. These events are sent to index "wineventlog" by default. I have a second universal forwarder which sends windows event log through an intermediate heavy forwarder connected to the indexer cluster. For some reason, these events are sent to index "main". There is no index specifier for the Windows events in any of the inputs.conf files. Why is this occurring and how do I get all of the events going to a single index (preferably "wineventlog")?

[somesoni2 · Accepted solution]

The default index for any input where index name is not specified in the inputs.conf is main. As a best practice I would explicitly specify the index name in all my data inputs.

To troubleshoot this you can run btool to see which index is being applied and from which conf file

$Splunk_Home/bin/splunk cmd btool inputs list --debug

Run this on both the Universal forwarders, search the attribute corresponding toyour WIndow event log and check the index name.