Getting Data In

Is it possible to use multiple indexes in a single server?

bwniranjan
New Member

We have a multiple logs in a single server. But, I want to separate those logs to control access. Can we send different log files to different indexes so that we can segrate the logs to users?

Tags (2)
0 Karma

prakash007
Builder

If you have a universal forwarder installed on your host, yes-you can send those logs to different indexes...for instance you can have your inputs configured this way..

inputs.conf
[monitor:///var/log/httpd]
sourcetype = access_common
index = web_access 

[monitor:///var/log/messages]
sourcetype = syslog
index = linux_os
0 Karma

renjith_nair
Legend

@bwniranjan,
Yes of course! You can use multiple indexes in same indexer .

Read though this documentation and let us know in case you have further questions.

How to create multiple indexes
Monitor files and directories with inputs.conf
Input conf for monitor

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...