Log keeps sending to index=main

[splunktrainingu]

Hello, 

I been trying to figure this out for the past 2 days now and I cannot seem to find which config file is making my host send logs to index=main. I have 4 other machines in forward management that have the same application sending logs to the correct index except for this system. It seems to send Application logs to index=main but all other security logs go to index=windows. I double checked the apps folder on that machine  and compared it with a machine that is not sending to index main and also did the same in the etc/system/local.  

This is a single deployment we have a single search head and single indexer. 

[inventsekar]

Hi @splunktrainingu ..
Q - I cannot seem to find which config file is making my host send logs to index=main.

Answers:
1. on the forwarder(s), you can run the btool command.

2. on the forwarder(s), you can view the inputs.conf file directly and see which log file is sending data to which index.

3. on splunk GUI, when you search for the logs from a host/forwarder, you can list down the source, sourcetype as well.
for example: 

index=main host=UF-hostname | table source sourcetype index _raw _time

(PS - i have given around 500+ karma points so far, received badge for that, if an answer helped you, a karma point would be nice!. we all should start "Learn, Give Back, Have Fun")

[renjith_nair · Accepted solution]

Try btool on the source machine to check whether any apps/local inputs.conf configured with index main

Reference : https://docs.splunk.com/Documentation/Splunk/8.0.6/Troubleshooting/Usebtooltotroubleshootconfigurati...

[splunktrainingu]

Thank you! from now on I am going to use this! It was so easy to see for some reason there was a inputs.conf in SplunkUniversalforwarder/etc/app/splunkuniversalforwarder/local/inputs.conf

I used the command

splunk btool inputs list --debug