Getting Data In

How can I forward to a specific custom index?

MU_IT
New Member

I would like to aggregate data from my NPS servers for helpdesk/support use. I have set up a custom index on each server, and I can pull up data with searches on each inside these indexes. How would I forward just the data in a custom index to my central splunk server?

I hope to set up a search on my central server for "NPS Login Failures" and the like against index="NPS_LOGS".

I am 100% windows, using 4.1.2 on all systems.

Thanks.

Tags (2)
0 Karma

Mick
Splunk Employee
Splunk Employee

If it's the case that you want to index some data locally and forward other data to another indexer, then you want to route the data using the instructions here.

Alternatively, you can just index the data on your local instance as well as your remote instance, by specifying your custom index in the appropriate index in inputs.conf and then using indexAndForward = true in outputs.conf.

Whatever your requirements are, there will likely be some data-routing work involved if you want to have different data available in different instances.

A much simpler alternative is just put your data into a custom index on your main indexer, and then restrict the relevant users to only having search privileges on that index. You can then provide access locally on that instance, or use a remote instance to distribute searches

Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...