Getting Data In

How to change the target index for logs from certain servers with a Windows universal forwarder, but keep the correct sourcetype?



I have one Splunk Enterprise server and a number of Windows servers with the Universal forwarder installed and configured to send logs to the server (indexer).

The logs all arrive and get tagged with the index 'wineventlog' and an appropriate sourcetype, 'WinEventLog:Security' or 'WinEventLog:System' etc. - All good stuff.

However, I'd like to change the index for certain servers (as I have done for various switches etc.). I have tried this using props.conf and transforms.conf with rules like this:


TRANSFORMS-winevent_dmz = set_index_winevent_dmz


DEST_KEY = _MetaData:Index
FORMAT = winevent_dmz

But when I do this, although the index does change, the appropriate sourcetype stops being applied and the logs all get assigned a 'splunkd' sourcetype.

Can anyone explain why this happens and let me know the correct way to change the index of logs coming from the Forwarder, but keep the correct sourcetype?


0 Karma


I agree with @maciep , if you still want to move to other index at the index time, please check if you can do it by using sourcetype
For example:


TRANSFORMS-winevent_dmz = set_index_winevent_dmz


SOURCE_KEY = MetaData:Host
DEST_KEY = _Metadata:Index
FORMAT = winevent_dmz
0 Karma


Look like you are applying that change to all data coming from that host. That includes splunk's internal log files. Are you sure that you're not just accidentally sending the _internal data to the winevent_dmz index now? Maybe along with the eventlog data? That would explain the splunkd sourcetype.

Also, it might be easier to just do this from the frowarder on winserver01 in the inputs.conf. Just update the index there. If you have windows app installed, just be sure to make your changes in the local directory instead of default.

0 Karma

Esteemed Legend

I don't know why it is happening but you can add a sourcetype= directive to your props.conf stanza to force it back.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...