Getting Data In

How to define custom index and sourcetype for Universal Forwarder

harshal_chakran
Builder

Hi,

I am using an Universal Forwarder to send a specific file to a Splunk instance on another machine. On this machine, by default it takes "main" as its index and a random sourcetype.

I want to define index and sourcetype of my own. At which end should I do the changes "Universal forwarder" or "Splunk instance" and What?

Please Help...!!!

1 Solution

MuS
SplunkTrust
SplunkTrust

Hi harshal_chakranarayan,

set your sourcetype and index in inputs.conf on your universal forwarder.

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi harshal_chakranarayan,

set your sourcetype and index in inputs.conf on your universal forwarder.

cheers, MuS

keekkenen
Engager

it's doesn't work.. how correct define index ?
I created index in Splunk, made monitor with custom sourcetype and indexer, but after it nothing to happend.. No errors, no data transfer and, of course, no indexing..

What's wrong ?

If I use monitor without custom index - all correct work..

0 Karma

0YAoNnmRmKDg
Path Finder

maybe share your inputs.conf

here is how to specify the index from the docs as MuS suggested

index = <string>
* Sets the index to store events from this input.
* Primarily used to specify the index to store events coming in via this input
  stanza.
* Detail: Sets the index key's initial value. The key is used when selecting an
  index to store the events.
* Defaults to "main" (or whatever you have set as your default index).

also check your default role permissions for default indexs searched or go for a good old 15 minute search of

index=*

to check all indexes

keekkenen
Engager

Thanks, I didn't see result of index work - it's worked and make index.
Yes, my mistake is absence permissions for using index - I forgot add index to using role.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...