All Apps and Add-ons

How to change what index SEP logs get set to?

TheSplunkDude
Explorer

By Default all the SEP logs are going to the main index, how do I change this so it would go to a custom "SEP" index?

0 Karma
1 Solution

rpille_splunk
Splunk Employee
Splunk Employee

If you are using the conf files for configuration, try adding index = SEP to each stanza.

If you are configuring on a node that has a Splunk Web UI, you can select an index on the Input Settings screen as you go through the GUI steps to define each file monitor input.

View solution in original post

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

If you are using the conf files for configuration, try adding index = SEP to each stanza.

If you are configuring on a node that has a Splunk Web UI, you can select an index on the Input Settings screen as you go through the GUI steps to define each file monitor input.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...