Where are TCP and UDP inputs indexed?

[lguinn2]

When I configure network inputs (TCP or UDP), I provide the port number and sourcetype, but there is nowhere to specify the index. Where are these inputs indexed? Can I change the index that is used for network inputs?

[V_at_Splunk · Accepted solution]

Unless otherwise specified, all data goes into the default index.

If adding network input through CLI, you can specify index with the -index option. (Issue splunk help add for syntax help.)

If adding network input through Manager » Data inputs » TCP » Add New or Manager » Data inputs » UDP » Add New, you should see an Index dropdown list. Is it there? What version are you using, please?

[balbano]

Is there someway to setup listening to one port and have it direct logs to a specific index depending on whitelist/blacklist?

What I mean is can you setup logs to go to multiple indexes through 1 listening port (e.g. TCP 514).

Brian

[Gaurav · Accepted solution]

In 4.0.x, you are indeed required to manually edit inputs.conf to specify an index for UDP/TCP inputs.

In 4.1, we'll be exposing index, host, and source configuration for all input types within Splunk Manager. In addition you'll be able to blacklist/whitelist from the UI for monitor inputs.

[V_at_Splunk · Accepted solution]

Unless otherwise specified, all data goes into the default index.

If adding network input through CLI, you can specify index with the -index option. (Issue splunk help add for syntax help.)

If adding network input through Manager » Data inputs » TCP » Add New or Manager » Data inputs » UDP » Add New, you should see an Index dropdown list. Is it there? What version are you using, please?

[hulahoop]

Since that is the sad case, then you must edit inputs.conf where the network input is defined and add the "index=foo" parameter to the input stanza.

[lguinn2]

version 4.0.9, build 74233

But there is no Index dropdown list in the web UI for either TCP or UDP inputs