Capabilities for edit_tcp with admin role

[goldorak]

Hello support,

I'm planning to use edit_tcp to send data for indexing to an REST endpoint in Splunk (no need to use a forwarder).

My question:

- Is it possible the send data to a specific Index or by default, it will send to all indexes ?

- Is it possible to restrict sending data to only one index ?

Thank you.

[s2_splunk · Accepted solution]

You may want to read up on the HTTP Event Collector if you are looking to push data to Splunk without using a forwarder.

Data is never sent to all indexes. You either need to be specific and specify an index (recommended) or data will be indexed into the configured default index.