Where in Splunk_Home on the forwarder do I make the configuration to change a target index?

[skoelpin]

I have several web services which need to be in the same index. Currently they are going to 2 different indexes..

Where in Splunk_Home can I go to change the forwarder so all my web services point to the same index?

[somesoni2 · Accepted solution]

To change the destination index for a data input (I guess this will be the data/log file from web services), you would have to update the "index" attribute in the corresponding inputs.conf entry. Do following:-

1) Login to your forwarder's physical server and run following command (example command for Linux OS)

/opt/splunk/bin/splunk cmd btool --debug inputs list

This will give list of all data inputs configured along with the path of inputs.conf file.

2) Identify the inputs.conf where the 2nd index, which need to be replaced, is being used. Go to the file, update the index = index2 line with index = index1, Save the file and restart the forwarder.