I use the following commands on my light forwarders to add an index and set new files to use it. /opt/splunkforwarder/bin/splunk add index java /opt/splunkforwarder/bin/splunk add monitor -index java
When using the universal forwarder I get this error: # /opt/splunkforwarder/bin/splunk add index java The object "index" is not supported on this installation.
What is the proper way to assign files to a specific index when using the universal forwarder?
Instead of creating the index at the forwarder/universalforwarder, you simply specify which index on the indexer the data should be sent to in your monitor stanza. Check out this section of the docs:
In 4.3.3 and going forward, there is a parameter (check-index) that you can set to make this to happen without getting an error message complaining about the nonexistent index. By setting check-index to false, Universal Forwarder would not require the index to be there to begin with, but this is not the default behavior in 4.3.3.
./splunk add monitor /var/log/case1 -index test_case1 -check-index false
The default behavior is different depending on the version