HF send data to specific index

[zafiro]

How can i setup the heavy forwarder to output data to a user created index in the indexer splunk instance?

My HF does not store data locally, I want it be sent only to the remote indexer.

I have tried setting up inputs.conf and outputs.conf but I'm not sure where is the right place to do this in the HF folder structure and if this is the correct approach. 

thank u!

[zafiro]

Thank you both for your response!

The data originates by a folder containing log files that is monitored by the HF directly. I managed to solve the problem by adding the index name in the etc/apps/SplunkDeloymentServerConfig/inputs.conf file.

[livehybrid · Accepted solution]

Hi @zafiro 

Is the data originating on the HF or is being sent to the HF from another source?

If its originating on the HF then you should be able to set index=<indexName> in the relevant stanzas of your inputs.conf on the HF. You'll need to restart for this to take affect.

If the data originates somewhere else then you'll need to use props/transforms to re-write the index name based, is it all data arriving on that HF that needs the index changing? What is the original index name its arriving on your indexers as?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[isoutamo]

As said you could use props+transforms or ingest actions to do this in HF, but it's always better to do this in inputs.conf on UF.
Of course if someone else is managing those UFs and you haven't (or cannot trust) control of those then you must setting index on HF side.