Getting Data In

How can I forward to a specific custom index?

New Member

I would like to aggregate data from my NPS servers for helpdesk/support use. I have set up a custom index on each server, and I can pull up data with searches on each inside these indexes. How would I forward just the data in a custom index to my central splunk server?

I hope to set up a search on my central server for "NPS Login Failures" and the like against index="NPS_LOGS".

I am 100% windows, using 4.1.2 on all systems.


Tags (2)
0 Karma

Splunk Employee
Splunk Employee

If it's the case that you want to index some data locally and forward other data to another indexer, then you want to route the data using the instructions here.

Alternatively, you can just index the data on your local instance as well as your remote instance, by specifying your custom index in the appropriate index in inputs.conf and then using indexAndForward = true in outputs.conf.

Whatever your requirements are, there will likely be some data-routing work involved if you want to have different data available in different instances.

A much simpler alternative is just put your data into a custom index on your main indexer, and then restrict the relevant users to only having search privileges on that index. You can then provide access locally on that instance, or use a remote instance to distribute searches

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...