Getting Data In

Problem with routing/forwarding to a specific index.

aaronzabell
Path Finder

I have a bunch of light forwarders sending data to a central heavy forwarder which then sends the data to the main indexer.

On the central heavy forwarder and the main indexer I've created an index called windows.

When I run a search on the main indexer, it doesn't look like all of the data is going into the windows index and I don't know why. In particular one Windows 7 Professional system (a light forwarder) and a Windows XP Pro system (the central heavy forwarder). The other systems are getting forwarded just fine (They consist of Win 2000, XP, Server 2003 and Server 2008 R2). Help?

On each light forwarder Ive placed inputs.conf in: %SPLUNK_HOME\etc\apps\SplunkLightForwarder\local\inputs.conf

[default]
index = windows

On the central heavy forwarder I've placed the inputs.conf in: %SPLUNK_HOME\etc\apps\SplunkForwarder\local\inputs.conf

[default]
index = windows
0 Karma
1 Solution

aaronzabell
Path Finder

Well, apparently on the 2 problem systems, this is the solution: I had to add the line

index = windows to

%SPLUNK_HOME\etc\system\local\inputs.conf

and

removed %SPLUNK_HOME\etc\apps\SplunkForwarder\local\inputs.conf (on the central heavy forwarder)

removed %SPLUNK_HOME\etc\apps\SplunkLightForwarder\local\inputs.conf (on the Windows 7 light forwarder)

I still have no clue why it needed to be different for these 2 systems.

View solution in original post

0 Karma

aaronzabell
Path Finder

Well, apparently on the 2 problem systems, this is the solution: I had to add the line

index = windows to

%SPLUNK_HOME\etc\system\local\inputs.conf

and

removed %SPLUNK_HOME\etc\apps\SplunkForwarder\local\inputs.conf (on the central heavy forwarder)

removed %SPLUNK_HOME\etc\apps\SplunkLightForwarder\local\inputs.conf (on the Windows 7 light forwarder)

I still have no clue why it needed to be different for these 2 systems.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

that's generally the right way, except that any particular input can override the default and send its data to a different index, and transforms can also change the target index.

0 Karma

aaronzabell
Path Finder

OK, I got the central forwarder fixed. I had to add the line index = windows to %SPLUNK_HOME\etc\system\local\inputs.conf and removed %SPLUNK_HOME\etc\apps\SplunkForwarder\local\inputs.conf

0 Karma

aaronzabell
Path Finder

OK, any idea as to why these 2 systems aren't cooperating then?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

No I am saying that the specific input can set a different index so your default may be overridden.

0 Karma

aaronzabell
Path Finder

So on those 2 systems do you think placing the inputs.conf in %SPLUNK_HOME\etc\system\local will do the trick?

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...