Getting Data In

forwarding data by identified index

makhambayeva
New Member

I have a Splunk Enterprise, which collects 3 different indexed data, I need to forward only one of them, how can I do this?

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

Hi @makhambayeva,
What does your inputs.conf look like? What kind of data are you collecting and how are you collecting it? Is the data you are looking to collect split out between different files/sources or combined into one? Depending on those answers there may be different solutions.

0 Karma

makhambayeva
New Member

to be exact, splunk forwards log-file to indexer, but , according to my thoughts, indexer cannot receive them. i see warning "received event from unconfigured/disabled/deleted index=secure. So far received events from missing index"

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

That means you are receiving the events but your inputs is telling them to go to index=secure and you don't have the index configured. What does your architecture look like? You would need that index configured at your indexer (https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes#Create_and_edit_ind...).

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

There is also a setting in indexes.conf that specified a lastChanceIndex. It is explained here: https://answers.splunk.com/answers/594449/what-happens-when-the-forwarder-is-configured-to-s.html. If your data has an index specified it can't get to it would go to what you specify here. People often configure it for main.

0 Karma

makhambayeva
New Member

I have two flows from different protective equipments (FortiGate, FortiSandox), which are sending data on certain tcp ports, and one auth log-file, which is stored on Splunk server on "/var/log/secure" directory. There are 3 diferent sources, but when I configure forwarding from web console, it send only information came from ports. How i need to configure inputs.conf in order to send data from certain file?

0 Karma

somesoni2
Revered Legend

Also, provide how data is currently being ingested and how you want it to be (with some examples).

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...