Forwarder works properly on initial install. Event logs are successfully exported into Splunk, but end up in the main index.
I modified inputs.conf and added
index = otherindex
After that, no data is transmitted. I know that the index is there as it is successfully displaying data that is coming in from our Linux hosts. I also tried simply adding index = otherindex under each type of Eventlog with the same results.
Maybe there is some kind of permission that is blocking these Windows hosts from writing to that index? (I'm not the Splunk admin so I don't know what's possible -- I'm merely deploying the client)
Some basic tips which you'd need to clarify if you've tried first;
index=otherindexin a search window? By default you won't probably be searching this index when you run searches unless its been added to your role.
I haven't. I only have access to the hosts on which I'm installing the forwarder. I can however make a suggestion to the Splunk admin if we narrow things down. Is there some kind of syntax that can be set to specifically send Windows Eventlogs going to main to another index?
I forgot to mention that I've done this on a couple Windows servers and the behavior is the same on each.
Yep. Every time I made a change to any of the conf files I restarted the SplunkForwarder Service.
I confirmed that I can do index=existingindex and it'll show things coming in.
I also confirmed that if I do host=windowshost it'll show things coming into main pretty much constantly, and stops when I add the index = line to inputs.conf.
It's an odd problem! I swear I'm doing everything by the docs.