Receiver to certain index

[FRoth]

I'd like to route received data (Receiver) to a certain index. I set an "index" in the "inputs.conf" but this didn't work.

[splunktcp://9997]
connection_host = ip
index = win_native

What I did: I configured a receiver on my splunk server and prepared an index on another partition that has enough space. (Index=win_native)

I would like to route all incoming data on that port (9997) to another index instead of the "main" index. The main index is located on a partition with only 5GB space.

I tried to accomplish this with the following changes but this didn't work neither.

In props.conf

[WinEventlog:Security]
TRANSFORMS-towinnativeindex = winnativeindex

In transforms.conf

[winnativeindex]
REGEX = .*
DEST_KEY = _MetaData:Index
FORMAT = win_native

Any ideas?

[FRoth]

Ahhhh - I missed a "typo" in the sourcetype. "WinEventlog" has to be "WinEventLog" with an uppercase "L". Now I use [source::WinEventLog...] as stanza and the transforms are applied.

[kristian_kolb]

It's better to set it up at source, so-to-speak, i.e. in inputs.conf on the forwarder;

[WinEventLog:Security]
disabled=0
index=win_native

Just ensure that the index exists on the receiving end, i.e. the indexer.

/K

[rsennett_splunk]

good point...

[rsennett_splunk]

When you say "it didn't work". Do you mean that cooked data came in on port 9997 and was indexed into the main index?

Is it possible that you have another inputs.conf with a similar declaration declaring index=main deliberately somewhere? You shouldn't really need the props and transforms in this case if you want everything coming on that port to go to the one index.