How to define specific Splunk indexers for different applications on the universal-forwarder?

[scottroymcse]

I have a requirement to log the default Windows logs using the universal forwarder to our main Splunk server, and then we have another application that needs to send logs to a different set of Splunk indexers.

I am pushing the applications to the UF host via a deployment server, however how do I specify that Application B use a different set of indexers?

I think I have a conflict in the outputs.conf when I have both Application A and Application B deployed to the UF host. The outputs.conf files are located in each of the /apps/ApplicationA/default and /apps/ApplicationB/default folders.

If I have just Application A or Application B pushed on their own, the required data is pushed to the correct Splunk indexer(s). Both installed at the same time ceases to send out anything.

[esix_splunk · Accepted solution]

In your inputs.conf for the app, you can specify the index that the data source goes into. Something like:

inputs.conf in App A
[monitor:///appA-sourcetype1]
sourcetype=appA-logfile
index=appA_index


inputs.conf in App B
[monitor:///appB-sourcetype1]
sourcetype=appB-logfile
index=appB_index

It should be noted that if you have the same sourcetype defined across multiple apps, then your configurations will be read in lexicographical order.