Getting Data In

Splunk_TA_Windows and non-standard index

jgorman_THG
Explorer

Hi!

I have several windows hosts with the Universal Forwarder and Splunk_TA_Windows installed. they are feeding into a heavy forwarder and being forwarded to SplunkCloud.

My Windows event logs from Splunk_TA_Windows are going into index "wineventlog".

I would like to use a non-standard index. I've tried editing inputs.conf on the heavy forw3arder and also tried changing transforms.conf and props.conf to re-direct but have had no luck.

Is it possible to make this change on the HF, or does it need to be made on each host? I'm getting the impression that changes like this to the Splunk_TA_Windows need to be made on each individual host. Can someone confirm this?

If it is possible on the HF how can it be done?

Thanks,

JG

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Using the Windows TA on the UF's, the endpoints, the Index is typically set on the inputs.conf. So if you are doing this, and routing this through HF before your indexers (or directly on your indexers..) you will need to rewrite the index destination.

So quickly, there are two options:

1) Update the inputs.conf on the windows endpoints, and set the index there. OR
2) Rewrite the destination index at the aggregation or index tiers..

Here's a post that outlines the props / transforms that need to be either on your aggregation HF tier, or on your indexers.

https://answers.splunk.com/answers/168491/routing-data-to-index-using-sourcetype.html

0 Karma

jgorman_THG
Explorer

Hello,

Thanks for your response.

So the 3 heavy forwarders are forwarding to SplunkCloud... I don't know if that makes a difference.

On all 3 forwarders in "C:\Program Files\Splunk\etc\system\local" I have created props.conf and transforms.conf files.

They read as follows:

Transforms:
[redirect_to_infrastructure]
DEST_KEY=_MetaData:index
REGEX = .
FORMAT = infrastructure

[redirect_to_security]
DEST_KEY=_MetaData:index
REGEX = .
FORMAT = security

[redirect_to_financial]
DEST_KEY=_MetaData:index
REGEX = .
FORMAT = financial

Props:
[host::TESTSERVER]
TRANSFORMS-index = redirect_to_security

As I understand that should tell the HeavyForwarders to send TESTSERVER data to the financial index in SplunkCloud, however I am not seeing that host in splunk cloud, it continues to go to wineventlog.

Any idea what I am doing wrong? I have restarted all 3 heavy Forwarders.

Thanks!!

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...