Getting Data In

Inputs not routing to correct index

rmcdougal
Path Finder

I have data being sent in by universal forwarders on port 9908 that I would like put into a custom index. This is how I have my C:\Program Files\Splunk\etc\system\local\inputs.conf setup.


[splunktcp://9908]
index = pc

However, the data from those universal forwarders is getting indexed into the "main" index. Any ideas why it is ignoring my index selection.

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion

The splunktcp input is for receiving "cooked" data (vs a raw TCP data input), so try specifying the "index" in the Universal Forwarder's inputs.conf instead.

If you do need to set the meta fields (index, sourcetype, source etc..) on the Receiver side using splunktcp , it is best to do this with index time field transforms using props.conf and transforms.conf

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...