All,
Using the universal forwarder for windows to send to my indexer. I have installed the Splunk app for Windows on the indexer. How does the indexer know the difference between Security, System, and Application logs? Is that figured out automajically?
Thanks,
Jim
I don't remember the defaults but in order to send different logs into different indexes you need to configure inputs.conf on the forwarder. Then the forwarder sets the destination index when sending data to indexer which simply obeys.