Getting Data In

How to define inputs.conf for selective indexing for data coming via REST API

danthebiman
New Member

I have a new data set being pushed via Splunk REST API. Because I am using selective indexing, I have some indexes stored locally, some don't. It's all set via _INDEX_AND_FORWARD_ROUTING.
However, it doesn't seem to work for this new data set coming in from the REST API.
Others are not via the REST API, and other data show up during the search.

Here is what I put in as a new stanza in inputs.conf.

[monitor:///opt/splunk/var/lib/splunk/new-ind/db]
index = new-ind
source = restAPI
sourcetype = web_event
_INDEX_AND_FORWARD_ROUTING = new-ind

Any help will be appreciated.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...