How do I get logs from network gear to a specific index?

[jmads]

I use Splunk on Windows. I have several heavy forwarders that forward Windows event logs to my indexer cluster into indexes named for the subnet where the Windows boxes reside. One such subnet has both Windows boxes and network gear. The Windows boxes send logs on port 9997 while the network gear sends on port 514 to the Heavy Forwarder. The logs from the Windows boxes show up in the appropriate index on the indexer cluster, but the network gear shows up in the Main index.

How can I get the logs from the network gear to show up in the Network index from that heavy Forwarder? I believe that the solution lies in creations/modifications to the transforms.conf and props.conf files in splunkhome\etc\system\local folder. I appreciate any help. Thanks!

[martin_mueller · Accepted solution]

If your HF is receiving the syslog data directly, look for an inputs.conf setting for udp:514 and add an index=mynetworkindex to it... ideally by running splunk btool --debug inputs list udp

If your HF's machine has a syslog daemon running that receives the data (better practice!), look for a monitor stanza in your HF's inputs.conf that reads the logs from the syslog daemon off disk, and set the network index in there.

[jmads]

Thanks, Martin! I have to unexpectedly leave work early today, but will give this a shot first thing Monday morning!

[jmads]

Martin, this worked like a champ! Thanks for the help!