Getting Data In

forwarding data by identified index

makhambayeva
New Member

I have a Splunk Enterprise, which collects 3 different indexed data, I need to forward only one of them, how can I do this?

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

Hi @makhambayeva,
What does your inputs.conf look like? What kind of data are you collecting and how are you collecting it? Is the data you are looking to collect split out between different files/sources or combined into one? Depending on those answers there may be different solutions.

0 Karma

makhambayeva
New Member

to be exact, splunk forwards log-file to indexer, but , according to my thoughts, indexer cannot receive them. i see warning "received event from unconfigured/disabled/deleted index=secure. So far received events from missing index"

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

That means you are receiving the events but your inputs is telling them to go to index=secure and you don't have the index configured. What does your architecture look like? You would need that index configured at your indexer (https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes#Create_and_edit_ind...).

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

There is also a setting in indexes.conf that specified a lastChanceIndex. It is explained here: https://answers.splunk.com/answers/594449/what-happens-when-the-forwarder-is-configured-to-s.html. If your data has an index specified it can't get to it would go to what you specify here. People often configure it for main.

0 Karma

makhambayeva
New Member

I have two flows from different protective equipments (FortiGate, FortiSandox), which are sending data on certain tcp ports, and one auth log-file, which is stored on Splunk server on "/var/log/secure" directory. There are 3 diferent sources, but when I configure forwarding from web console, it send only information came from ports. How i need to configure inputs.conf in order to send data from certain file?

0 Karma

somesoni2
Revered Legend

Also, provide how data is currently being ingested and how you want it to be (with some examples).

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...