configured sources for index in inputs.conf

[charyjpmc]

Hi All,

I would like to get all the source files configured(in inputs.conf) to particular index. Whether the source is reporting to the index or not, I want to see the values index wise.

Thanks in advance.

[deepashri_123]

Hey charyjpmc,

You can run the following query:
| metadata type=sources index=yourindex

Hope this helps!!!

[charyjpmc]

Thanks for reply ..

This query will help me to all the sources but if we have any rolling logs then it bring all those too..
I want only configured logs in inputs.conf file.

[FrankVl]

If you want to get an overview of which inputs are configured to go to which index, I guess you could get that using the btool command:
http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...

For example: ./splunk cmd btool inputs list

[gcusello]

Hi charyjpmc,
I'm not sure to understand your need: do you want to send all the inputs in one index?

To do this you have to insert in every room of your inputs.conf

index=my_index

If instead you don't want to insert this option in every room of inputs.conf, you can configure your Indexers to override index value.
To do this, you have to insert in every Indexers or heavy forwarder:
in your props.conf

 [mysourcetype]
 TRANSFORMS-index = overrideindex

in your transforms.conf

 [overrideindex]
 DEST_KEY =_MetaData:Index
 REGEX = .
 FORMAT = my_new_index

In this way, every event with sourcetype=mysourcetype will be sent to my_new_index.

Bye.
Giuseppe