Is there a possibility to send an internal log from a universal forwarders to a custom index?

[AbilashSe]

Can anyone please help me on this?
Is there any possibility to send universal forwarder internal logs to user specific index?

Thank you..!

[harsmarvania57 · Accepted solution]

Hi @AbilashSe,

Generally it is not best practice to send Internal logs to custom indexes but if you still want to send UF Internal logs to custom indexes then you can do below configuration in $SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/local/inputs.conf

inputs.conf on Windows UF

[monitor://$SPLUNK_HOME\var\log\splunk\splunkd.log]
index = CUSTOM_INDEX_NAME

[monitor://$SPLUNK_HOME\var\log\splunk\metrics.log]
index = CUSTOM_INDEX_NAME

inputs.conf on Linux UF

[monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log]
index = CUSTOM_INDEX_NAME

[monitor://$SPLUNK_HOME/var/log/splunk/metrics.log]
index = CUSTOM_INDEX_NAME

Restart splunk on UF.

[AbilashSe]

Hi @harsmarvania57 ,

Thank you for your help..!!

We arent going to jmplement this in UF, but i just wanted to get idea on this.

Regards,
Abilash

[harsmarvania57]

Hi,

Can we have an use case, why you would like to put it in custom index because Internal logs going to Internal indexes such as _internal , _introspection and those does not count against splunk license.

[AbilashSe]

Hi @harsmarvania57 ,

We have installed Splunk UF in one of my VM and i just wanted to forward the Splunk internal logs to my index.

[darrenfuller]

I can think of two off the top of my head

i want to keep forwarder logs for a different retention period than core Splunk internal logs

OR

I want forwarder logs to be on a cheaper disk than core Splunk internal logs.

[adonio]

you can increase the retention of the internal index
you can also play with volumes and have colddb on separate volume that maps to a cheaper disk.
also seen user summarizing some of the data that is important to them to a summary index and keep retention that way