Getting Data In

Splunk_TA_Windows and non-standard index



I have several windows hosts with the Universal Forwarder and Splunk_TA_Windows installed. they are feeding into a heavy forwarder and being forwarded to SplunkCloud.

My Windows event logs from Splunk_TA_Windows are going into index "wineventlog".

I would like to use a non-standard index. I've tried editing inputs.conf on the heavy forw3arder and also tried changing transforms.conf and props.conf to re-direct but have had no luck.

Is it possible to make this change on the HF, or does it need to be made on each host? I'm getting the impression that changes like this to the Splunk_TA_Windows need to be made on each individual host. Can someone confirm this?

If it is possible on the HF how can it be done?



0 Karma

Splunk Employee
Splunk Employee

Using the Windows TA on the UF's, the endpoints, the Index is typically set on the inputs.conf. So if you are doing this, and routing this through HF before your indexers (or directly on your indexers..) you will need to rewrite the index destination.

So quickly, there are two options:

1) Update the inputs.conf on the windows endpoints, and set the index there. OR
2) Rewrite the destination index at the aggregation or index tiers..

Here's a post that outlines the props / transforms that need to be either on your aggregation HF tier, or on your indexers.

0 Karma



Thanks for your response.

So the 3 heavy forwarders are forwarding to SplunkCloud... I don't know if that makes a difference.

On all 3 forwarders in "C:\Program Files\Splunk\etc\system\local" I have created props.conf and transforms.conf files.

They read as follows:

FORMAT = infrastructure

FORMAT = security

FORMAT = financial

TRANSFORMS-index = redirect_to_security

As I understand that should tell the HeavyForwarders to send TESTSERVER data to the financial index in SplunkCloud, however I am not seeing that host in splunk cloud, it continues to go to wineventlog.

Any idea what I am doing wrong? I have restarted all 3 heavy Forwarders.


0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...