Specify index for windows Eventlogs in Universal Forwarder

[johanbraeken]

Hi,

I've installed a Universal Forwarder and it is forwarding Windows events fine to the Splunk server.

Hoever, all Windows eventlogs are indexed in the "main" index of Spunk and I would like to have these indexed somwhere else.
I can't find out what stanza I should use to specify an index for the eventlogs in the config of the Universal forwarder.

The idea is to have multiple types of Windows hosts configured to use different indexes, all bering forwarded to the same Splunk server.

Best regards,

[kristian_kolb]

Please upvote a/o mark as accepted if your question was answered. Thanks.

Kristian

[kristian_kolb]

Locate the inputs.conf file on your forwarder. You will have several inputs.conf files, but the one to look for is the one containing the following stanza;

[WinEventLog:XXX]
disabled=0

XXX would be Application, Security or System (or all of those in separate stanzas in the file). There may be other parameters defined under each stanza heading. Just add another line specifying index=zzzz , where zzzz is an index you have configured on your indexer.

The most likely location to find the correct inputs.conf file would be in;

C:\Program Files\splunk\etc\apps\search\local
C:\Program Files\splunk\etc\apps\launcher\local
C:\Program Files\splunk\etc\apps\MSICreated\local
C:\Program Files\splunk\etc\system\local

Do not edit any file in a default-directory.

Hope this helps,

Kristian