forwarding data by identified index

[makhambayeva]

I have a Splunk Enterprise, which collects 3 different indexed data, I need to forward only one of them, how can I do this?

[mdsnmss]

Hi @makhambayeva,
What does your inputs.conf look like? What kind of data are you collecting and how are you collecting it? Is the data you are looking to collect split out between different files/sources or combined into one? Depending on those answers there may be different solutions.

[makhambayeva]

to be exact, splunk forwards log-file to indexer, but , according to my thoughts, indexer cannot receive them. i see warning "received event from unconfigured/disabled/deleted index=secure. So far received events from missing index"

[mdsnmss]

That means you are receiving the events but your inputs is telling them to go to index=secure and you don't have the index configured. What does your architecture look like? You would need that index configured at your indexer (https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes#Create_and_edit_ind...).

[mdsnmss]

There is also a setting in indexes.conf that specified a lastChanceIndex. It is explained here: https://answers.splunk.com/answers/594449/what-happens-when-the-forwarder-is-configured-to-s.html. If your data has an index specified it can't get to it would go to what you specify here. People often configure it for main.

[makhambayeva]

I have two flows from different protective equipments (FortiGate, FortiSandox), which are sending data on certain tcp ports, and one auth log-file, which is stored on Splunk server on "/var/log/secure" directory. There are 3 diferent sources, but when I configure forwarding from web console, it send only information came from ports. How i need to configure inputs.conf in order to send data from certain file?

[somesoni2]

Also, provide how data is currently being ingested and how you want it to be (with some examples).