Getting Data In

How can I forward to a specific custom index?

New Member

I would like to aggregate data from my NPS servers for helpdesk/support use. I have set up a custom index on each server, and I can pull up data with searches on each inside these indexes. How would I forward just the data in a custom index to my central splunk server?

I hope to set up a search on my central server for "NPS Login Failures" and the like against index="NPS_LOGS".

I am 100% windows, using 4.1.2 on all systems.


Tags (2)
0 Karma

Splunk Employee
Splunk Employee

If it's the case that you want to index some data locally and forward other data to another indexer, then you want to route the data using the instructions here.

Alternatively, you can just index the data on your local instance as well as your remote instance, by specifying your custom index in the appropriate index in inputs.conf and then using indexAndForward = true in outputs.conf.

Whatever your requirements are, there will likely be some data-routing work involved if you want to have different data available in different instances.

A much simpler alternative is just put your data into a custom index on your main indexer, and then restrict the relevant users to only having search privileges on that index. You can then provide access locally on that instance, or use a remote instance to distribute searches

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...