Getting Data In

Inputs not routing to correct index

rmcdougal
Path Finder

I have data being sent in by universal forwarders on port 9908 that I would like put into a custom index. This is how I have my C:\Program Files\Splunk\etc\system\local\inputs.conf setup.


[splunktcp://9908]
index = pc

However, the data from those universal forwarders is getting indexed into the "main" index. Any ideas why it is ignoring my index selection.

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion

The splunktcp input is for receiving "cooked" data (vs a raw TCP data input), so try specifying the "index" in the Universal Forwarder's inputs.conf instead.

If you do need to set the meta fields (index, sourcetype, source etc..) on the Receiver side using splunktcp , it is best to do this with index time field transforms using props.conf and transforms.conf

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...