How to define custom index and sourcetype for Universal Forwarder

[harshal_chakran]

Hi,

I am using an Universal Forwarder to send a specific file to a Splunk instance on another machine. On this machine, by default it takes "main" as its index and a random sourcetype.

I want to define index and sourcetype of my own. At which end should I do the changes "Universal forwarder" or "Splunk instance" and What?

Please Help...!!!

[MuS · Accepted solution]

Hi harshal_chakranarayan,

set your sourcetype and index in inputs.conf on your universal forwarder.

cheers, MuS

[keekkenen]

it's doesn't work.. how correct define index ?
I created index in Splunk, made monitor with custom sourcetype and indexer, but after it nothing to happend.. No errors, no data transfer and, of course, no indexing..

What's wrong ?

If I use monitor without custom index - all correct work..

[0YAoNnmRmKDg]

maybe share your inputs.conf

here is how to specify the index from the docs as MuS suggested

index = <string>
* Sets the index to store events from this input.
* Primarily used to specify the index to store events coming in via this input
  stanza.
* Detail: Sets the index key's initial value. The key is used when selecting an
  index to store the events.
* Defaults to "main" (or whatever you have set as your default index).

also check your default role permissions for default indexs searched or go for a good old 15 minute search of

index=*

to check all indexes

[keekkenen]

Thanks, I didn't see result of index work - it's worked and make index.
Yes, my mistake is absence permissions for using index - I forgot add index to using role.