Getting Data In

How to define specific Splunk indexers for different applications on the universal-forwarder?

New Member

I have a requirement to log the default Windows logs using the universal forwarder to our main Splunk server, and then we have another application that needs to send logs to a different set of Splunk indexers.

I am pushing the applications to the UF host via a deployment server, however how do I specify that Application B use a different set of indexers?

I think I have a conflict in the outputs.conf when I have both Application A and Application B deployed to the UF host. The outputs.conf files are located in each of the /apps/ApplicationA/default and /apps/ApplicationB/default folders.

If I have just Application A or Application B pushed on their own, the required data is pushed to the correct Splunk indexer(s). Both installed at the same time ceases to send out anything.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

In your inputs.conf for the app, you can specify the index that the data source goes into. Something like:

inputs.conf in App A
[monitor:///appA-sourcetype1]
sourcetype=appA-logfile
index=appA_index


inputs.conf in App B
[monitor:///appB-sourcetype1]
sourcetype=appB-logfile
index=appB_index

It should be noted that if you have the same sourcetype defined across multiple apps, then your configurations will be read in lexicographical order.

View solution in original post

Splunk Employee
Splunk Employee

In your inputs.conf for the app, you can specify the index that the data source goes into. Something like:

inputs.conf in App A
[monitor:///appA-sourcetype1]
sourcetype=appA-logfile
index=appA_index


inputs.conf in App B
[monitor:///appB-sourcetype1]
sourcetype=appB-logfile
index=appB_index

It should be noted that if you have the same sourcetype defined across multiple apps, then your configurations will be read in lexicographical order.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!