Hi Community,
One of the log source (e.g. index=my_index) at my company's splunk became inter=main. After multiple investigation, i found that Infrastructure Team has refreshed the device to a new hardware due to product EOL (same brand, same product, e.g. Palo Alto 3020 to PA3220). Also, the device IP is changed.
Thus, i have modified the monitoring path at inputs.conf in Add-on and distribute to HF by deployment server.
Here is the example for what i modified:
[monitor:///siem/data/syslog/192.168.1.101/*] #original ip was 192.168.1.100
disabled = false
index = my_index
sourcetype = my:sourcetype
host_segment = 4
After such changes, i tried to verify the result on HF, the inputs.conf was successfully update to the new version.
However, the logs remain to index=main when searching on Search Head after the changes i did above.
Anyone know if any other thing i need to modify? Or else there are other root cause that making the logs fall under wrong index apart from the ip changes?
