Getting Data In

Splunk_TA_Windows and non-standard index



I have several windows hosts with the Universal Forwarder and Splunk_TA_Windows installed. they are feeding into a heavy forwarder and being forwarded to SplunkCloud.

My Windows event logs from Splunk_TA_Windows are going into index "wineventlog".

I would like to use a non-standard index. I've tried editing inputs.conf on the heavy forw3arder and also tried changing transforms.conf and props.conf to re-direct but have had no luck.

Is it possible to make this change on the HF, or does it need to be made on each host? I'm getting the impression that changes like this to the Splunk_TA_Windows need to be made on each individual host. Can someone confirm this?

If it is possible on the HF how can it be done?



0 Karma

Splunk Employee
Splunk Employee

Using the Windows TA on the UF's, the endpoints, the Index is typically set on the inputs.conf. So if you are doing this, and routing this through HF before your indexers (or directly on your indexers..) you will need to rewrite the index destination.

So quickly, there are two options:

1) Update the inputs.conf on the windows endpoints, and set the index there. OR
2) Rewrite the destination index at the aggregation or index tiers..

Here's a post that outlines the props / transforms that need to be either on your aggregation HF tier, or on your indexers.

0 Karma



Thanks for your response.

So the 3 heavy forwarders are forwarding to SplunkCloud... I don't know if that makes a difference.

On all 3 forwarders in "C:\Program Files\Splunk\etc\system\local" I have created props.conf and transforms.conf files.

They read as follows:

FORMAT = infrastructure

FORMAT = security

FORMAT = financial

TRANSFORMS-index = redirect_to_security

As I understand that should tell the HeavyForwarders to send TESTSERVER data to the financial index in SplunkCloud, however I am not seeing that host in splunk cloud, it continues to go to wineventlog.

Any idea what I am doing wrong? I have restarted all 3 heavy Forwarders.


0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...