Getting Data In

Configure universal forwarder to send all logs to a specific index regardless of what logs are being ingested

Runals
Motivator

I feel like I'm asking a question I should know the answer to. We are setting up what will be a large and distributed splunk environment. The probable scenario is individual orgs will have one or more forwarders and we'd like to have all of the data from any particular org going into its own index regardless of log content: OS, firewall, etc. Unless I'm off base the place to configure which index data will go is the inputs.conf file. Even though we will be using a deployment server the individual orgs will be responsible for installing the UF/HF and ultimately will have access to modify things like the etc/local/inputs.conf file even if we tell them not to.

Since the forwarder builds the inputs.conf file from the various places it can reside my thought is to create an inputs.conf app for all forwarders in an org that says regardless of WHAT is being ingested to put it in the right index. This would be appended to whatever they might tweak outside of my perview. Is this the right approach and how do I accomplish this? My thought is something like the following

deployment-apps/all_forwarders_in_org_xyz_inputs/local/inputs.conf

[source:*]
index=xyz's_index

That stanza string doesn't strike me as the right way to approach this.

Tags (1)
0 Karma
1 Solution

bmacias84
Champion

You can just set the [default] stanza in your inputs.conf within your deployment app.


[default]
index=##yourNewDefaultIndex##

Thank you @yannK
Answers default index for all forwards inputs

View solution in original post

bmacias84
Champion

You can just set the [default] stanza in your inputs.conf within your deployment app.


[default]
index=##yourNewDefaultIndex##

Thank you @yannK
Answers default index for all forwards inputs

Runals
Motivator

Good deal. Thanks!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>