How to redirect uf log to specific index in indexer

[kitkit321]

Hi everyone,

I would like to ask how to redirect uf log to a specific index in indexer.

I cannot modify the uf outputs.conf so is there any other method that can allow me to put the log in other index rather than the main index(UF default setting). 

the source type is WinEventLog

Or is there any method that can control the outputs.conf in indexer level? assuming there is only one indexer and one uf

[scelikok]

Hi @kitkit321,

You don't need to modify outputs.conf for index settings. Index setting is done per input stanza.

If you are using Splunk Web to create inputs you can specify index for that input as below;

https://docs.splunk.com/Documentation/Splunk/8.1.1/Data/MonitorWindowseventlogdata#Specify_input_set... 

If you have access to UF inputs.conf you should just put index name inside stanza. I put a sample below to send three different sourcetypes to different indexes.;

[WinEventLog://Application]
disabled = 0 
index=win_application

[WinEventLog://Security]
disabled = 0 
index=win_security

[WinEventLog://System]
disabled = 0
index=win_system 

If this reply helps you an upvote is appreciated.

[gcusello]

Hi @kitkit321,

at first, you can assign index on UFs not in outputs.conf but in inputs.conf.

Then, if you cannot modify inputs.conf in UFs, you can override index following the steps at https://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides (for sourcetype, but the process is the same).

In few words, you have to put in your Indexers or (when present) Heavy Forwarders:

in props.conf:

[mysourcetype]
TRANSFORMS-index = overrideindex

In transforms.conf:

[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = .
FORMAT = my_new_index

Ciao.

Giuseppe