Getting Data In

Forwarder send Windows Events to different indexes

insidious
New Member

I have a universal forwarder pointed to the indexer cluster which sends Windows event logs. These events are sent to index "wineventlog" by default. I have a second universal forwarder which sends windows event log through an intermediate heavy forwarder connected to the indexer cluster. For some reason, these events are sent to index "main". There is no index specifier for the Windows events in any of the inputs.conf files. Why is this occurring and how do I get all of the events going to a single index (preferably "wineventlog")?

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The default index for any input where index name is not specified in the inputs.conf is main. As a best practice I would explicitly specify the index name in all my data inputs.

To troubleshoot this you can run btool to see which index is being applied and from which conf file

$Splunk_Home/bin/splunk cmd btool inputs list --debug

Run this on both the Universal forwarders, search the attribute corresponding toyour WIndow event log and check the index name.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

The default index for any input where index name is not specified in the inputs.conf is main. As a best practice I would explicitly specify the index name in all my data inputs.

To troubleshoot this you can run btool to see which index is being applied and from which conf file

$Splunk_Home/bin/splunk cmd btool inputs list --debug

Run this on both the Universal forwarders, search the attribute corresponding toyour WIndow event log and check the index name.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...