Forwarding events to different indexes

[krugger]

Hi,

I have a universal forwarder that is monitoring a couple of text log files on a AD server. Now I would like to have the universal forwarder also monitor the windows event logs. So I currently have the following config in the input.conf;

[monitor://E:\App\serverlog.txt]
disabled = false 
index=appserver

I have read through the manual and I am going to add:

[WinEventLog:Application]
disabled = 0 
[WinEventLog:Security]
disabled = 0 
[WinEventLog:System]
disabled = 0 

[WinEventLog:DNS Server]
disabled = 0
[WinEventLog:Directory Service]
disabled = 0
[WinEventLog:File Replication Service]
disabled = 0

However I would like to have the logs from the AD in their own indexes and not all mixed up with the appserver index. I have installed the Splunk for AD addon.

Should I just add a index=adlog or something like that to the input.conf at the universal forwarder? Does the Splunk for AD split the logs to their own index automatically?

[stefano_guidoba · Accepted solution]

Hi krugger,

you just need to add to every stanza in your inputs.conf file the index you prefer.
So, taking your example:

[WinEventLog:Application]
disabled=0
index=adlog

This way, splunk will index that data undex adlog index. Also, I suggest to diversify your inputs assigning them different sourcetypes, specifying it in your inputs.conf under the "index" entry.
Regards,

Stefano

[kristian_kolb]

Do not forget to create the index on the indexer. Splunk will not create it for you automatically. Basic configuration of indexes can be done from the manager.

Also, you do not need to assign sourcetypes for windows event logs, as they will automatically get the source and sourcetype set to WinEventLog:XXXXX for each value of XXXXX, in the monitor stanzas.

/k