Getting Data In

Splunk forwarder, how can I forward data to some port with some index name and different sourcetypes for different files?

axl88
Communicator

Splunk forwarder, how can I forward data to same port at different server with same index name and different sourcetypes for different files?

Moreover all above is possible in light forwarder?
Could you give an example for changes on .conf files?
**Like
myindex appAsourcetype
myindex appBsourcetype
secondindex appCsourcetype (this is not a must, just extra knowledge if someone knows)

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The Universal Forwarder can have index and sourcetype defined for its sources. The definition works in inputs.conf just like on a standalone Splunk instance. You'll find documentation here: http://docs.splunk.com/Documentation/Splunk/6.0.3/Data/Editinputs.conf

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...