Our Splunk 6.1.5 environment is on Linux. We have universal forwarders installed on our windows machines. They are already forwarding data to index "oswindows". I have another index "testapplicationindex" that some of my servers are forwarding other types of logs. Now, I also need to forward the Windows event log "application" to this "testapplicationindex".
I know that I can add the following lines to "inputs.conf" file for the second app(index), but I am not sure if it is the correct way as we already have this information in "oswindows" and by doing this, we are indexing that data twice.
disabled = false
You probably want an eventtype here. Then you can specify where your data lives a little more granular. Do this on the Searchheads and Indexers.
eventtypes.conf [wineventlog_application] search = sourcetype=WinEventLog:Application index=os_windows OR index=test_application_index
Then in your search bar, do this:
eventtype=wineventlog_application | do_other_things_here
Thanks for the reply, please correct me if I am wrong,
by what you have mentioned I believe you are assuming that the wineventlogapplication is already in both indexes which is not my case, my wineventlogapplication is just in oswindows and I need to send it to testapplication_index
So then whereever that input "WinEventLog:Application" is being collected from, create a local/inputs.conf with this in it:
[WinEventLog:Application] index = test_application_index
This will override the input and put it into the new index. You can't (and shouldn't) send it to both, so anything using os_windows will stop working.
Yes, I assumed that I should add this lines to the inputs.conf of those machine (windows machines) forwarding the logs, but my concern or question is by doing that aren't we indexing same data twice? indexing in oswindows by default and indexing in testapplication_index which will cost us the license usage.
Nope, the config is overwritten - you won't see the same data in two different indexes unless you do some really fancy configurations. If you goto C:\Program Files\SplunkUniversalForwarder\bin, and run:
./splunk.exe cmd btool --debug inputs list WinEventLog:Application
You will see what values are set, and what file they come from.
I have install UF on our central syslog server. that syslog server is getting logs from different network devices.
logs files are getting saved at /central/$devicename$
I wan to save logs under index = syslog_route index.