Splunk_TA_Windows and non-standard index

[jgorman_THG]

Hi!

I have several windows hosts with the Universal Forwarder and Splunk_TA_Windows installed. they are feeding into a heavy forwarder and being forwarded to SplunkCloud.

My Windows event logs from Splunk_TA_Windows are going into index "wineventlog".

I would like to use a non-standard index. I've tried editing inputs.conf on the heavy forw3arder and also tried changing transforms.conf and props.conf to re-direct but have had no luck.

Is it possible to make this change on the HF, or does it need to be made on each host? I'm getting the impression that changes like this to the Splunk_TA_Windows need to be made on each individual host. Can someone confirm this?

If it is possible on the HF how can it be done?

Thanks,

JG

[esix_splunk]

Using the Windows TA on the UF's, the endpoints, the Index is typically set on the inputs.conf. So if you are doing this, and routing this through HF before your indexers (or directly on your indexers..) you will need to rewrite the index destination.

So quickly, there are two options:

1) Update the inputs.conf on the windows endpoints, and set the index there. OR
2) Rewrite the destination index at the aggregation or index tiers..

Here's a post that outlines the props / transforms that need to be either on your aggregation HF tier, or on your indexers.

https://answers.splunk.com/answers/168491/routing-data-to-index-using-sourcetype.html

[jgorman_THG]

Hello,

Thanks for your response.

So the 3 heavy forwarders are forwarding to SplunkCloud... I don't know if that makes a difference.

On all 3 forwarders in "C:\Program Files\Splunk\etc\system\local" I have created props.conf and transforms.conf files.

They read as follows:

Transforms:
[redirect_to_infrastructure]
DEST_KEY=_MetaData:index
REGEX = .
FORMAT = infrastructure

[redirect_to_security]
DEST_KEY=_MetaData:index
REGEX = .
FORMAT = security

[redirect_to_financial]
DEST_KEY=_MetaData:index
REGEX = .
FORMAT = financial

Props:
[host::TESTSERVER]
TRANSFORMS-index = redirect_to_security

As I understand that should tell the HeavyForwarders to send TESTSERVER data to the financial index in SplunkCloud, however I am not seeing that host in splunk cloud, it continues to go to wineventlog.

Any idea what I am doing wrong? I have restarted all 3 heavy Forwarders.

Thanks!!