Getting Data In

Unable to index mulesoft logs from Main index to another customized index.

Swkadam
New Member

Hi,

We have integrated Mulesoft with splunk and logs are sending to the heavy forwarder and indexing into "Main" index then forwarding to the indexers.

On Heavy forwarder we have created new index and assigned into the Http collector event but still logs are not indexing into the newly created index.

So do i need to create same new index on indexers as all indexers are in cluster mode.

0 Karma
1 Solution

ashpatel_splunk
Splunk Employee
Splunk Employee

The issue of the HEC events not being written to the newly created index on the HF is unrelated to the indexing tier. For the sake of clarity, can you confirm that you:

  1. Created a new index
  2. Edited the HEC from Data Inputs and in "Select Allowed Indexes" you removed Main and added your newly created index (i.e. - new_index)
  3. When you search index="new_index" you see no events? You tried running a curl test with the HEC token and there are still no events in there?

Remember, new created index may not be searched by default based on the index configuration and other RBAC setting.

View solution in original post

0 Karma

ashpatel_splunk
Splunk Employee
Splunk Employee

The issue of the HEC events not being written to the newly created index on the HF is unrelated to the indexing tier. For the sake of clarity, can you confirm that you:

  1. Created a new index
  2. Edited the HEC from Data Inputs and in "Select Allowed Indexes" you removed Main and added your newly created index (i.e. - new_index)
  3. When you search index="new_index" you see no events? You tried running a curl test with the HEC token and there are still no events in there?

Remember, new created index may not be searched by default based on the index configuration and other RBAC setting.

0 Karma

Richfez
SplunkTrust
SplunkTrust

EDIT: I moved this to a comment: ashpatel's answer is perfectly fine, so now that it's published it, he should get the credit here. 🙂 I didn't just delete the below because it could still be useful.

In fact, I think you need to do two additional things.

1) Create the index on your indexers. That's where the data is going, so that's where the indexes the data is going in to need to be.

2) Also you might need to edit the HTTP Event Collector and change it to allow it to index into that index. When you created it, if the index where these events are supposed to go you wouldn't have been able to pick it as an allowed index for that HEC to send events to, so you have to go back and reselect that again.

Then I think it should work.

Let us know how that goes!

-Rich

0 Karma

Swkadam
New Member

Thanks for your valuable reply.

It is working now.

0 Karma

Swkadam
New Member

Now we are getting mulesoft logs to newly created index on indexers but with other sourcetype also like syslogs . So we want to exclude sourcetype "syslogs" from newly created index.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...