Getting Data In

How?: Forward specific syslog events to specific index


We have a VIP setup to load balance and forward all our syslog events to a pair of Non-indexing Splunk Heavy Forwarders. The forwarders then send to a 3rd party IDS as well as a pair of load balanced indexers that are connected to a search head.

We are about to send new syslog data to the VIP and want all data to go to a new index that we created. We would rather NOT create a new listening port on the Forwarders for this new traffic.

How do we send the specific syslog events to the specific index? Would this have to be done on the indexing side?

Thanks in advance for any help.

Tags (3)
1 Solution

0 Karma


We are in the process of setting up a new AV server that has the ability to send events via syslog to Splunk. We do not want this going to the default index as this is not data that we need to retain for a long period of time. Does that answer your question? Thank you in advance for any help.

0 Karma

Path Finder

Before I even take a stab at answering the question ... what makes the data new? Is it from a new source entirely, or are there very specific events that you're looking to change the index on going forward?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...