How to forward Windows event log "application" to 2 different indexes?

[KooroshFooladba]

Our Splunk 6.1.5 environment is on Linux. We have universal forwarders installed on our windows machines. They are already forwarding data to index "os_windows". I have another index "test_application_index" that some of my servers are forwarding other types of logs. Now, I also need to forward the Windows event log "application" to this "test_application_index".
I know that I can add the following lines to "inputs.conf" file for the second app(index), but I am not sure if it is the correct way as we already have this information in "os_windows" and by doing this, we are indexing that data twice.

Any suggestions?

[WinEventLog:Application]
disabled = false
index=test_application_index

[alacercogitatus]

You probably want an eventtype here. Then you can specify where your data lives a little more granular. Do this on the Searchheads and Indexers.

eventtypes.conf
[wineventlog_application]
search = sourcetype=WinEventLog:Application index=os_windows OR index=test_application_index

Then in your search bar, do this:

eventtype=wineventlog_application | do_other_things_here

[KooroshFooladba]

Thanks for the reply, please correct me if I am wrong,
by what you have mentioned I believe you are assuming that the wineventlog_application is already in both indexes which is not my case, my wineventlog_application is just in os_windows and I need to send it to test_application_index

[alacercogitatus]

So then whereever that input "WinEventLog:Application" is being collected from, create a local/inputs.conf with this in it:

[WinEventLog:Application]
index = test_application_index

This will override the input and put it into the new index. You can't (and shouldn't) send it to both, so anything using os_windows will stop working.

[KooroshFooladba]

Yes, I assumed that I should add this lines to the inputs.conf of those machine (windows machines) forwarding the logs, but my concern or question is by doing that aren't we indexing same data twice? indexing in os_windows by default and indexing in test_application_index which will cost us the license usage.

Thanks

[alacercogitatus]

Nope, the config is overwritten - you won't see the same data in two different indexes unless you do some really fancy configurations. If you goto C:\Program Files\SplunkUniversalForwarder\bin, and run:

./splunk.exe cmd btool --debug inputs list WinEventLog:Application

You will see what values are set, and what file they come from.

[riqbal]

I have install UF on our central syslog server. that syslog server is getting logs from different network devices.
logs files are getting saved at /central/$devicename$
I wan to save logs under index = syslog_route index.

[KooroshFooladba]

Thanks,

I will try it today and will confirm tomorrow.