Getting Data In

configured sources for index in inputs.conf

charyjpmc
New Member

Hi All,

I would like to get all the source files configured(in inputs.conf) to particular index. Whether the source is reporting to the index or not, I want to see the values index wise.

Thanks in advance.

0 Karma

deepashri_123
Motivator

Hey charyjpmc,

You can run the following query:
| metadata type=sources index=yourindex

Hope this helps!!!

0 Karma

charyjpmc
New Member

Thanks for reply ..

This query will help me to all the sources but if we have any rolling logs then it bring all those too..
I want only configured logs in inputs.conf file.

0 Karma

FrankVl
Ultra Champion

If you want to get an overview of which inputs are configured to go to which index, I guess you could get that using the btool command:
http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...

For example: ./splunk cmd btool inputs list

0 Karma

gcusello
Legend

Hi charyjpmc,
I'm not sure to understand your need: do you want to send all the inputs in one index?

To do this you have to insert in every room of your inputs.conf

index=my_index

If instead you don't want to insert this option in every room of inputs.conf, you can configure your Indexers to override index value.
To do this, you have to insert in every Indexers or heavy forwarder:
in your props.conf

 [mysourcetype]
 TRANSFORMS-index = overrideindex

in your transforms.conf

 [overrideindex]
 DEST_KEY =_MetaData:Index
 REGEX = .
 FORMAT = my_new_index

In this way, every event with sourcetype=mysourcetype will be sent to my_new_index.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...