Hi,
I am using an Universal Forwarder to send a specific file to a Splunk instance on another machine. On this machine, by default it takes "main" as its index and a random sourcetype.
I want to define index and sourcetype of my own. At which end should I do the changes "Universal forwarder" or "Splunk instance" and What?
Please Help...!!!
Hi harshal_chakranarayan,
set your sourcetype and index in inputs.conf on your universal forwarder.
cheers, MuS
Hi harshal_chakranarayan,
set your sourcetype and index in inputs.conf on your universal forwarder.
cheers, MuS
it's doesn't work.. how correct define index ?
I created index in Splunk, made monitor with custom sourcetype and indexer, but after it nothing to happend.. No errors, no data transfer and, of course, no indexing..
What's wrong ?
If I use monitor without custom index - all correct work..
maybe share your inputs.conf
here is how to specify the index from the docs as MuS suggested
index = <string>
* Sets the index to store events from this input.
* Primarily used to specify the index to store events coming in via this input
stanza.
* Detail: Sets the index key's initial value. The key is used when selecting an
index to store the events.
* Defaults to "main" (or whatever you have set as your default index).
also check your default role permissions for default indexs searched or go for a good old 15 minute search of
index=*
to check all indexes
Thanks, I didn't see result of index work - it's worked and make index.
Yes, my mistake is absence permissions for using index - I forgot add index to using role.