All Apps and Add-ons

Splunk Add-on for Microsoft Windows: How do I specify which index to send data to?

andrewtrobec
Builder

Hello,

I've just installed the Splunk Add-on for Microsoft Windows and I will be collecting data from UFs that forward first to a HF and then to an indexing cluster.  The app will be deployed to multiple UFs via deployment server.  I only want to collect data from the machines that the UFs are installed on.

I see that there is no way to specify within inputs.conf which index to send the data to.  I've read the documentation but I still don't understand how.  I've even found this post which discusses the same topic but doesn't really provide me with an answer that I understand (sends me to documentation for older version of the add-on).

Could somebody please give me a push in the right direction?

Thank you and best regards,

Andrew

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Specify the destination index in inputs.conf.  Simply insert a new line in the appropriate stanza with index = followed by the name of index.  See the examples at https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/Configuration#Configure_inputs.conf

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

andrewtrobec
Builder

@richgalloway thank you so much, I don't know how I didn't figure that out.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Specify the destination index in inputs.conf.  Simply insert a new line in the appropriate stanza with index = followed by the name of index.  See the examples at https://docs.splunk.com/Documentation/WindowsAddOn/8.1.2/User/Configuration#Configure_inputs.conf

---
If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

Is there something different you have to do for a HF-HF-INDEXER than a UF-HF-INDEXER?

My UF-HF-Indexers is working great however I need to add a HF-HF-Indexer as well The first HF sends to other ...

How to write query for including non business hours and weekends

Hi ,I need a query for including non business hours and weekends

Persistent Queue uses more space than allocated- How do I edit inputs.conf?

Hello,we have a problem with persistent queue's in our infrastructure.We have TCP inputs sending SSL traffic ...