I'm gathering data from two machines, and depending on which one it comes from, it has a different index. Both universal forwarders have the same inputs.conf which looks like
[monitor://C:\Windows\.marimba\MarimbaEndpointTuner\history-y*.log]
disabled=0
index = main
sourcetype = marimba
Can anyone think of a reason as to why they are being put in separate indexes?
Got the problem fixed. I went under appslearned and deleted all of the contents in each folder on the Universal Forwarders. Now, they both are coming up with an index of main. Thanks for the suggestion.
Got the problem fixed. I went under appslearned and deleted all of the contents in each folder on the Universal Forwarders. Now, they both are coming up with an index of main. Thanks for the suggestion.
Check your indexer for transforms.conf rules that overwrite the index based on some criterion.
Got the problem fixed. I went under \apps\learned and deleted all of the contents in each folder on the Universal Forwarders. Now, they both are coming up with an index of main. Thanks for the suggestion.