Getting Data In

Where in Splunk_Home on the forwarder do I make the configuration to change a target index?

skoelpin
SplunkTrust
SplunkTrust

I have several web services which need to be in the same index. Currently they are going to 2 different indexes..

Where in Splunk_Home can I go to change the forwarder so all my web services point to the same index?

0 Karma
1 Solution

somesoni2
Revered Legend

To change the destination index for a data input (I guess this will be the data/log file from web services), you would have to update the "index" attribute in the corresponding inputs.conf entry. Do following:-

1) Login to your forwarder's physical server and run following command (example command for Linux OS)

/opt/splunk/bin/splunk cmd btool --debug inputs list

This will give list of all data inputs configured along with the path of inputs.conf file.

2) Identify the inputs.conf where the 2nd index, which need to be replaced, is being used. Go to the file, update the index = index2 line with index = index1, Save the file and restart the forwarder.

View solution in original post

somesoni2
Revered Legend

To change the destination index for a data input (I guess this will be the data/log file from web services), you would have to update the "index" attribute in the corresponding inputs.conf entry. Do following:-

1) Login to your forwarder's physical server and run following command (example command for Linux OS)

/opt/splunk/bin/splunk cmd btool --debug inputs list

This will give list of all data inputs configured along with the path of inputs.conf file.

2) Identify the inputs.conf where the 2nd index, which need to be replaced, is being used. Go to the file, update the index = index2 line with index = index1, Save the file and restart the forwarder.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.