Getting Data In

UF data going to wrong index

Path Finder

I have a UF on an rsyslog server. The UF is forwarding logs to the indexer successfully, but one of my two input flows is going to the wrong index, and I can't figure it out. 



index = first_index

sourcetype = first_index

host_segment = 4

disabled = false


index = second_index

sourcetype = second_index

host_segment = 4

disabled = false

Data of sourcetype second_index makes it to the corresponding index, but data of sourcetype first_index ends up in the main index. 

The only props and transforms I have configured are from the VMware add-on and its accessories, but I've scoured its conf files and have not found anything that would send this non-VMware data to main instead of where it belongs when it's specified in $SPLUNK_HOME/etc/system/local/inputs.conf.

Any ideas? Thx!

Labels (1)
0 Karma


Hello @whar_garbl 

Can you run following btool command from splunk bin directiry to check runtime confguration of inputs config

its shows inputs config from all splunk directory to check any thoer stanza which is taking precence to send the data to main index instaed of first_index for source /path/number/one/*

splunk btool inputs list --debug 

sample output



0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...