Getting Data In

How to send data to a custom index which is currently being sent to main index?

amulay26
Path Finder

Am trying to solve a problem here. The inputs.conf for one of the monitoring stanza on the forwarder had index = main . I changed the inputs.conf on Deployment server and defined index = a and enabled restart splunkd. Am able to see an updated inputs.conf with index = a under the monitoring stanza. However, when I do a btool, I still see index = main for the same monitoring stanza.

How do I send data to index = a instead of index = main?

Any help will be appreciated. Thanks.

Tags (1)
0 Karma

pramit46
Contributor

Please check whether or not you are using the correct serverclass. Perhaps the configuration is not even getting pushed into the forwarder. Hence even if you change on the DS, the FWD still shows the older version.

0 Karma

amulay26
Path Finder

The serverclass is correct too.

0 Karma

amulay26
Path Finder

I did a btool as well. There is no alternate inputs.conf on the Forwarder.

0 Karma

Mayurmpatil
Path Finder

Hello @amulay26 - may be there is one more inputs.conf in some other app or system local in your splunk enterprise.
with below command please find it.

/opt/splunk/bin/splunk cmd btool inputs list --debug | grep index

you will get all the inputs.conf files splunk is using in you environment .

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...