Getting Data In
Highlighted

Two diffent indexes

Path Finder

Is it possible to send different logs on two different indexes

[default]
host = EDGE1

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

[WinEventLog://Microsoft-Windows-WinNat/Oper]
disabled = 0
index = DAlogs
whitelist = 1017,4303,2000,4304,1018

[monitor:///C:\Program Files\lognlb]
disabled = 0
sourcetype = csv
index = nlb
log

Tags (3)
0 Karma
Highlighted

Re: Two diffent indexes

Ultra Champion

Sure, in the monitor, you specify the exact log path and its corresponding index.

View solution in original post

0 Karma
Highlighted

Re: Two diffent indexes

Path Finder

The sintax in the inputs.conf reported above is it correct? Can you please add an example

0 Karma
Highlighted

Re: Two diffent indexes

SplunkTrust
SplunkTrust

Yes, the index name is available for each data input stanza and each input stanza can be configured to a different indexes (index should exist on the indexer)

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.