Getting Data In

forwarding data by identified index

makhambayeva
New Member

I have a Splunk Enterprise, which collects 3 different indexed data, I need to forward only one of them, how can I do this?

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

Hi @makhambayeva,
What does your inputs.conf look like? What kind of data are you collecting and how are you collecting it? Is the data you are looking to collect split out between different files/sources or combined into one? Depending on those answers there may be different solutions.

0 Karma

makhambayeva
New Member

to be exact, splunk forwards log-file to indexer, but , according to my thoughts, indexer cannot receive them. i see warning "received event from unconfigured/disabled/deleted index=secure. So far received events from missing index"

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

That means you are receiving the events but your inputs is telling them to go to index=secure and you don't have the index configured. What does your architecture look like? You would need that index configured at your indexer (https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes#Create_and_edit_ind...).

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

There is also a setting in indexes.conf that specified a lastChanceIndex. It is explained here: https://answers.splunk.com/answers/594449/what-happens-when-the-forwarder-is-configured-to-s.html. If your data has an index specified it can't get to it would go to what you specify here. People often configure it for main.

0 Karma

makhambayeva
New Member

I have two flows from different protective equipments (FortiGate, FortiSandox), which are sending data on certain tcp ports, and one auth log-file, which is stored on Splunk server on "/var/log/secure" directory. There are 3 diferent sources, but when I configure forwarding from web console, it send only information came from ports. How i need to configure inputs.conf in order to send data from certain file?

0 Karma

somesoni2
Revered Legend

Also, provide how data is currently being ingested and how you want it to be (with some examples).

0 Karma
Get Updates on the Splunk Community!

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...

New This Month in Splunk Observability Cloud - Synthetic Monitoring updates, UI ...

This month, we’re delivering several platform, infrastructure, application and digital experience monitoring ...