Getting Data In

How to forward Windows event log "application" to 2 different indexes?

Our Splunk 6.1.5 environment is on Linux. We have universal forwarders installed on our windows machines. They are already forwarding data to index "oswindows". I have another index "testapplicationindex" that some of my servers are forwarding other types of logs. Now, I also need to forward the Windows event log "application" to this "testapplicationindex".
I know that I can add the following lines to "inputs.conf" file for the second app(index), but I am not sure if it is the correct way as we already have this information in "os
windows" and by doing this, we are indexing that data twice.

Any suggestions?

[WinEventLog:Application]
disabled = false
index=testapplicationindex

0 Karma

SplunkTrust
SplunkTrust

You probably want an eventtype here. Then you can specify where your data lives a little more granular. Do this on the Searchheads and Indexers.

eventtypes.conf
[wineventlog_application]
search = sourcetype=WinEventLog:Application index=os_windows OR index=test_application_index

Then in your search bar, do this:

eventtype=wineventlog_application | do_other_things_here
0 Karma

Thanks for the reply, please correct me if I am wrong,
by what you have mentioned I believe you are assuming that the wineventlogapplication is already in both indexes which is not my case, my wineventlogapplication is just in oswindows and I need to send it to testapplication_index

0 Karma

SplunkTrust
SplunkTrust

So then whereever that input "WinEventLog:Application" is being collected from, create a local/inputs.conf with this in it:

[WinEventLog:Application]
index = test_application_index

This will override the input and put it into the new index. You can't (and shouldn't) send it to both, so anything using os_windows will stop working.

0 Karma

Yes, I assumed that I should add this lines to the inputs.conf of those machine (windows machines) forwarding the logs, but my concern or question is by doing that aren't we indexing same data twice? indexing in oswindows by default and indexing in testapplication_index which will cost us the license usage.

Thanks

0 Karma

SplunkTrust
SplunkTrust

Nope, the config is overwritten - you won't see the same data in two different indexes unless you do some really fancy configurations. If you goto C:\Program Files\SplunkUniversalForwarder\bin, and run:

./splunk.exe cmd btool --debug inputs list WinEventLog:Application

You will see what values are set, and what file they come from.

0 Karma

Communicator

I have install UF on our central syslog server. that syslog server is getting logs from different network devices.
logs files are getting saved at /central/$devicename$
I wan to save logs under index = syslog_route index.

0 Karma

Thanks,

I will try it today and will confirm tomorrow.

0 Karma