Hello there,
For context, I got some remote logs from different sources on my universal forwarder, and I'm trying to index logs from the same source with the same index, but the thing is, I don't know how to that 😕
I tried to follow this Create custom indexes - Splunk Documentation, but even trying to index everything that comes from my universal forwarder using this
[tcp://<ip_addr_forwarder]
index=<name_of_index]
can someone help please ?
Best regards,
Hi @aatik5u,
you have to read the following documentation https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain where the way to ingest data is described in detailed mode.
The destination index is a secondary problem, the main issue is how to take logs.
Ciao.
Giuseppe