Getting Data In

Inputs not routing to correct index

rmcdougal
Path Finder

I have data being sent in by universal forwarders on port 9908 that I would like put into a custom index. This is how I have my C:\Program Files\Splunk\etc\system\local\inputs.conf setup.


[splunktcp://9908]
index = pc

However, the data from those universal forwarders is getting indexed into the "main" index. Any ideas why it is ignoring my index selection.

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion

The splunktcp input is for receiving "cooked" data (vs a raw TCP data input), so try specifying the "index" in the Universal Forwarder's inputs.conf instead.

If you do need to set the meta fields (index, sourcetype, source etc..) on the Receiver side using splunktcp , it is best to do this with index time field transforms using props.conf and transforms.conf

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...