Getting Data In

how route data to specific index when we use heavy forwarder?

manikanta66
Explorer

I build distributed Splunk Enterprise network the network flow is like below
UF--->HF------->IDX----->SH
In which I monitor a log file using inputs.conf
[monitor:///var/log/syslog]
disabled = false
index = new_indexer

I also created a new index in Indexer

But the log files are not indexing in indexer.

if I remove the index stanza in inputs.conf file the data is now indexing on the indexer.

Now here my question
How I specify the index to route the data to specific index?

0 Karma

woodcock
Esteemed Legend

You need to put your monitor stanza on the UF node and then make sure that it has index=new_index_not_new_indexer. Then make sure that that same UF has an outputs.conf file that points to your indexer tier (OR to your HF tier but preferably not to HF as you probably should not be using an HF tier anyway). Then restart Splunk on your UF to start sending in. Your problem is probably that you are confusing index (the name of the DB where you data buckets are stored) and indexer (the server that has it's own subset of all the index data). There is no indexer setting in inputs.conf, only index settings. Similarly, there is no index setting in outputs.conf, only indexer settings.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Validate that your index name is new_indexer and not new_index.

Otherwise, you need to switch those configurations, and change the inputs to be new_index on the UF where you have the inputs.conf.

0 Karma

jkat54
SplunkTrust
SplunkTrust

What is the index name on the indexer? Is that the name you’re using in inputs.conf?

0 Karma

jkat54
SplunkTrust
SplunkTrust

What is the index name on the indexer? Is that the name you’re using in inputs.conf?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!