Getting Data In

UF data going to wrong index

Path Finder

I have a UF on an rsyslog server. The UF is forwarding logs to the indexer successfully, but one of my two input flows is going to the wrong index, and I can't figure it out. 



index = first_index

sourcetype = first_index

host_segment = 4

disabled = false


index = second_index

sourcetype = second_index

host_segment = 4

disabled = false

Data of sourcetype second_index makes it to the corresponding index, but data of sourcetype first_index ends up in the main index. 

The only props and transforms I have configured are from the VMware add-on and its accessories, but I've scoured its conf files and have not found anything that would send this non-VMware data to main instead of where it belongs when it's specified in $SPLUNK_HOME/etc/system/local/inputs.conf.

Any ideas? Thx!

Labels (1)
0 Karma


Hello @whar_garbl 

Can you run following btool command from splunk bin directiry to check runtime confguration of inputs config

its shows inputs config from all splunk directory to check any thoer stanza which is taking precence to send the data to main index instaed of first_index for source /path/number/one/*

splunk btool inputs list --debug 

sample output



0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...