Getting Data In

Forwarding events to different indexes

krugger
Communicator

Hi,

I have a universal forwarder that is monitoring a couple of text log files on a AD server. Now I would like to have the universal forwarder also monitor the windows event logs. So I currently have the following config in the input.conf;

[monitor://E:\App\serverlog.txt]
disabled = false 
index=appserver

I have read through the manual and I am going to add:

[WinEventLog:Application]
disabled = 0 
[WinEventLog:Security]
disabled = 0 
[WinEventLog:System]
disabled = 0 

[WinEventLog:DNS Server]
disabled = 0
[WinEventLog:Directory Service]
disabled = 0
[WinEventLog:File Replication Service]
disabled = 0

However I would like to have the logs from the AD in their own indexes and not all mixed up with the appserver index. I have installed the Splunk for AD addon.

Should I just add a index=adlog or something like that to the input.conf at the universal forwarder? Does the Splunk for AD split the logs to their own index automatically?

0 Karma
1 Solution

stefano_guidoba
Communicator

Hi krugger,

you just need to add to every stanza in your inputs.conf file the index you prefer.
So, taking your example:

[WinEventLog:Application]
disabled=0
index=adlog

This way, splunk will index that data undex adlog index. Also, I suggest to diversify your inputs assigning them different sourcetypes, specifying it in your inputs.conf under the "index" entry.
Regards,

Stefano

View solution in original post

stefano_guidoba
Communicator

Hi krugger,

you just need to add to every stanza in your inputs.conf file the index you prefer.
So, taking your example:

[WinEventLog:Application]
disabled=0
index=adlog

This way, splunk will index that data undex adlog index. Also, I suggest to diversify your inputs assigning them different sourcetypes, specifying it in your inputs.conf under the "index" entry.
Regards,

Stefano

kristian_kolb
Ultra Champion

Do not forget to create the index on the indexer. Splunk will not create it for you automatically. Basic configuration of indexes can be done from the manager.

Also, you do not need to assign sourcetypes for windows event logs, as they will automatically get the source and sourcetype set to WinEventLog:XXXXX for each value of XXXXX, in the monitor stanzas.

/k

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...