The modular input only lists indexes on the local Splunk instance. The heavy forwarder where the add-on is installed sends events to a cluster. How do I specify an index that is not one of the local indexes, i.e. whatever index name I want?
You can create the index on the heavyforwarder so the add-on sees it as an option, as long as the heavyforwarder is set to send everything to your indexers, the data will be forwarded and not indexed locally.
You can create the index on the heavyforwarder so the add-on sees it as an option, as long as the heavyforwarder is set to send everything to your indexers, the data will be forwarded and not indexed locally.
That solution occurred to me, but I don't like it. It would be better to have a text box instead of a drop down for the index name.
My temporary solution is to rewrite the index metadata. Thanks for the app!
[duo:administrator]
TRANSFORMS-duo_administrator = duo_set_index
[duo:authentication]
TRANSFORMS-duo_authentication = duo_set_index
[duo:info_summary]
TRANSFORMS-duo_info_summary = duo_set_index
[duo:telephony]
TRANSFORMS-duo_telephony = duo_set_index
[duo_set_index]
REGEX = .+
DEST_KEY = _MetaData:Index
FORMAT = some_index