Getting Data In

Universal Forwarders Technology Addons

aelliott
Motivator

I'm new to the Universal Forwarders and wanted to make sure I had this process correct. Some of the apps require specific TA's to be used.

Step 1: Open Port on receiving machine.
Step 2: Install Universal Forwarder on forwarding machine.
Step 3: Install TA on universal Forwarder

What index does this data go into on the receiving machine and is there a way to control this?
If it is in a specific piece of documentation please let me know.
I am using this as a reference but did not see this information in there:
http://docs.splunk.com/Documentation/WindowsApp/latest/User/InstalltheSplunkAppforWindows

1 Solution

kristian_kolb
Ultra Champion

You can contol the destination index for your data via inputs.conf.

[monitor:///blah/blah]
index=my_index

If not set, it will default to 'main'. Destination index can also be changed through index-time transforms, there are some docs examples on how this process works for altering sourcetypes;

http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

Though for changing the index in this fashion, the DEST_KEY and assignment is slightly different;

DEST_KEY = _MetaData:Index
FORMAT = my_index

vs.

DEST_KEY = MetaData:Host
FORMAT = host::my_host

/k

View solution in original post

kristian_kolb
Ultra Champion

You can contol the destination index for your data via inputs.conf.

[monitor:///blah/blah]
index=my_index

If not set, it will default to 'main'. Destination index can also be changed through index-time transforms, there are some docs examples on how this process works for altering sourcetypes;

http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

Though for changing the index in this fashion, the DEST_KEY and assignment is slightly different;

DEST_KEY = _MetaData:Index
FORMAT = my_index

vs.

DEST_KEY = MetaData:Host
FORMAT = host::my_host

/k

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...