winevent index location

[a212830]

Hi,

I have a customer who configured a universal forwarder and now wants to send their files to my indexer. I do not want to use "main" as the index, however. I can't find where the index association is for winevent logs. Can someone point me to it?

[dstaulcu]

For future reference, If you run .\bin\splunk.exe cmd bool inputs list --debug on the agent in question it will list input settings in effect and the input.conf instances from which those settings are derived.

[dstaulcu · Accepted solution]

Inputs.conf

index =

• Sets the index to store events from this input.

• Primarily used to specify the index to store events coming in via this

input stanza.

• Detail: Sets the index key's initial value. The key is used when

selecting an index to store the events.

• Defaults to "main" (or whatever you have set as your default index).

[a212830]

Thanks. I realize the inputs.conf is where the indexer gets identified, I was looking for which inputs.conf is used for windows events. I found it in the MsiCreated directory.