How to index logs from the same source with the same index?

[aatik5u]

Hello there, 

For context, I got some remote logs from different sources on my universal forwarder, and I'm trying to index logs from the same source with the same index, but the thing is, I don't know how to that 😕

I tried to follow this Create custom indexes - Splunk Documentation, but even trying to index everything that comes from my universal forwarder using this

[tcp://<ip_addr_forwarder]

index=<name_of_index]

can someone help please ?

Best regards,

[gcusello]

Hi @aatik5u,

you have to read the following documentation https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain where the way to ingest data is described in detailed mode.

The destination index is a secondary problem, the main issue is how to take logs.

Ciao.

Giuseppe