Getting Data In

How to configure universal forwarder to forward events from a specific log file in a monitored directory to a separate index?

gn694
Communicator

I have a Windows computer where I need to configure the Splunk Universal Forwarder in the following way:

One large log directory is indexed in the "main" index. There are a lot of log files here.
One specific log file in this directory needs to go to a separate index (for longer retention purposes.)

What is the best way to handle this? I think setting a blacklist value for this specific log file is the best way, but was curious of anyone has any other input.

But... what would happen if I have a monitoring stanza for the whole directory going to one index and another monitoring stanza for the ONE file in the directory going into another index? If it would get indexed twice that is not a problem in this case. But I suspect Splunk is not going to forward the events from that one file twice, once into each index.

Here is my Proposed Solution for indexes.conf:

[default]
index=main

[monitor://C:\logs]
disabled = 0
ignoreOlderThan = 7d
blacklist=C:\logs\onelog.log

[monitor://C:\logs\onelog.log]
index=NewIndex
disabled = 0
1 Solution

kml_uvce
Builder

This is correct way to blacklist the file that you want to send in another index.
Yes,It would be indexed twice in different index if you send same file in different index.

View solution in original post

kml_uvce
Builder

This is correct way to blacklist the file that you want to send in another index.
Yes,It would be indexed twice in different index if you send same file in different index.

Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...