Why can't I change ingest index for WinEventLog?

[andrewixl]

Hello, I am fairly new to the splunk administration side of things.

I am attempting to change the ingest index for WinEventLog from index=main > index=windows

I am on a single instance splunk enterprise system.

I have tried two methods both on the splunk server:

1.  props.conf and transforms.conf

/opt/splunk/etc/system/local/transforms.conf:

[RedirectWinEventLog]
REGEX = WinEventLog
DEST_KEY = _MetaData:Index
FORMAT = windows

[Redirectwineventlog]
REGEX = wineventlog
DEST_KEY = _MetaData:Index
FORMAT = windows

/opt/splunk/etc/system/local/props.conf:

[WinEventLog]
TRANSFORMS-index = RedirectWinEventLog

[wineventlog]
TRANSFORMS-index = Redirectwineventlog

After restarting splunk and the Windows UF, the logs were still going to index=main

2. input.conf

/opt/splunk/etc/system/local/inputs.conf

[WinEventLog]
index = windows

After restarting splunk and the Windows UF, the logs were still going to index=main

I am at my witts end searching documentation and forums.

Any help would be greatly appreciated.

[woodcock]

It could be many things including:

It is "inputs.conf", not "input.conf" and this file needs to be sent to the UF itself which will NOT have a "/opt/splunk/etc/system/local/" directory (it would be "/opt/splunkforwarder/etc/system/local/", but that is not really the right place for it in any case).

If you are using transforms like this, the pros.conf/transforms.conf files must be deployed to the first full instance of Splunk that handles those events.  Assuming that you are using Windows UF (there are MANY other options for getting Windows Events), this means EITHER your indexers (every one of them) OR your HF tier (best to be safe and send it everywhere).