Getting Data In

Index main

juls0125
New Member

Hello Splunkers!

I have a question, i have installed a universal forwarder on a AIX server, but all the logs arrives on the index "main", they should be arrive in one especific index that i created. How can i fix this issue and why is this happening?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Check the inputs.conf file(s) on the forwarder to confirm an index is specified for each input.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Check the inputs.conf file(s) on the forwarder to confirm an index is specified for each input.

---
If this reply helps you, Karma would be appreciated.

juls0125
New Member

i have added the next information on the inputs.conf file without any change (informix is the index)

[monitor://$SPLUNK_HOME/audit]
index = informix

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you restart Splunk after making the change?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...