I am new to splunk, want to forward my logs by universal forwarder to specific index by CLI. Please help me out.
Hi there is a guide in the Splunk Documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Setupforwardingandreceiving
However a simple overview, would be to configure your input stanzas (on the Universal forwarder) in $SPLUNK_HOME/etc/apps/search/localinputs.conf file, e.g.
[monitor:///opt/log/vmail]
sourcetype = iis-2
host_regex = iis_(.*)\.log
Then on the indexer (receiver) configure $SPLUNK_HOME/etc/system/local/inputs.conf to listen on the forwarders unique port which you choose (e.g. 8011 in this example)...
[default]
host = ubuntu
[splunktcp://8011]
index=universaForwarder #(for example)
Then back on the forwarder, configure your $SPLUNK_HOME/etc/system/local/outputs.conf file with the address/port numbers you want to forward to, e.g. (here I forward to another Splunk instance on my same machine, so only need to change port number)....
[tcpout]
defaultGroup = 127.0.0.1_8011
disabled = false
[tcpout:127.0.0.1_8011]
server = 127.0.0.1:8011
Gaurav_a,
There are a few ways to do this. The most straight-forward way is to add the "index=foo" line to your stanzas in inputs.conf as described in the docs. For example, if this were for a UF on Windows to collect normal WinEventLogs, and you want to forward events to an index called "windows", you could add the index line to your inputs.conf to make it look like this:
[WinEventLog:Security]
index=windows
You can also achieve the same results via the Splunk CLI commands.
There are also more advanced techniques if they suite your use-case more appropriately.
Best,
Sean