Getting Data In

winevent index location

a212830
Champion

Hi,

I have a customer who configured a universal forwarder and now wants to send their files to my indexer. I do not want to use "main" as the index, however. I can't find where the index association is for winevent logs. Can someone point me to it?

Tags (1)
0 Karma
1 Solution

dstaulcu
Builder

Inputs.conf

index =

  • Sets the index to store events from this input.

  • Primarily used to specify the index to store events coming in via this

input stanza.

  • Detail: Sets the index key's initial value. The key is used when

selecting an index to store the events.

  • Defaults to "main" (or whatever you have set as your default index).

View solution in original post

0 Karma

dstaulcu
Builder

For future reference, If you run .\bin\splunk.exe cmd bool inputs list --debug on the agent in question it will list input settings in effect and the input.conf instances from which those settings are derived.

0 Karma

dstaulcu
Builder

Inputs.conf

index =

  • Sets the index to store events from this input.

  • Primarily used to specify the index to store events coming in via this

input stanza.

  • Detail: Sets the index key's initial value. The key is used when

selecting an index to store the events.

  • Defaults to "main" (or whatever you have set as your default index).
0 Karma

a212830
Champion

Thanks. I realize the inputs.conf is where the indexer gets identified, I was looking for which inputs.conf is used for windows events. I found it in the MsiCreated directory.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...