Getting Data In

How to define specific Splunk indexers for different applications on the universal-forwarder?

scottroymcse
New Member

I have a requirement to log the default Windows logs using the universal forwarder to our main Splunk server, and then we have another application that needs to send logs to a different set of Splunk indexers.

I am pushing the applications to the UF host via a deployment server, however how do I specify that Application B use a different set of indexers?

I think I have a conflict in the outputs.conf when I have both Application A and Application B deployed to the UF host. The outputs.conf files are located in each of the /apps/ApplicationA/default and /apps/ApplicationB/default folders.

If I have just Application A or Application B pushed on their own, the required data is pushed to the correct Splunk indexer(s). Both installed at the same time ceases to send out anything.

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

In your inputs.conf for the app, you can specify the index that the data source goes into. Something like:

inputs.conf in App A
[monitor:///appA-sourcetype1]
sourcetype=appA-logfile
index=appA_index


inputs.conf in App B
[monitor:///appB-sourcetype1]
sourcetype=appB-logfile
index=appB_index

It should be noted that if you have the same sourcetype defined across multiple apps, then your configurations will be read in lexicographical order.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

In your inputs.conf for the app, you can specify the index that the data source goes into. Something like:

inputs.conf in App A
[monitor:///appA-sourcetype1]
sourcetype=appA-logfile
index=appA_index


inputs.conf in App B
[monitor:///appB-sourcetype1]
sourcetype=appB-logfile
index=appB_index

It should be noted that if you have the same sourcetype defined across multiple apps, then your configurations will be read in lexicographical order.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...