Getting Data In

Universal forwarder not using updated index property in inputs.conf

jstockamp
Communicator

While i was working on a few transforms I pointed my forwarder to a "test" index. Once I got the transforms working the way I wanted to, I tried to point the forwarder back to my "main" index, but it doesn't seem to be picking up my change. I've restarted the Windows Universal Forwarder service a few times with no effect. Here's the inputs definition from $SPLUNK_HOME/etc/system/local/inputs.conf (on the forwarder):

[monitor://D:\LogFiles\W3SVC1]
disabled = 0
index = main
whitelist = ex(\d+).log
sourcetype = iis-2

The indexer continues to insert these events into the "test" index instead of "main". Any ideas why this is happening?

Tags (2)

jstockamp
Communicator

I'm not setting the index with any of my transforms ... only filtering out some unwanted data.

0 Karma

hazekamp
Builder

Got it. Was not sure what transforms you were referring to. Your settings look correct.

0 Karma

hazekamp
Builder

jstockamp,

Can you verify that your indexer(s) is not affecting the target index. Any index routing props/transforms defined based on host/source/sourcetype for this data could be affecting the target index.

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...