Getting Data In

Forwarder data going to main index

m314219
Explorer

I setup the Universal Forwarder on several Windows servers and pointed it towards my Splunk instance.

After installing the forwarder, I went to Splunk web > Add Data > Forward > Event Logs and selected the 'WindowsServer' server class that I had setup and selected my index called 'windows'.

However, despite the 'windows' index being set, all of the data coming from my universal forwarders is going into my 'main' index.

How can I correct this?

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

@m314219 The btool output on inputs.conf will show your configured inputs. If there is no 'index=' attribute defined, then the events will go to the default index 'main'. You can edit inputs.conf directly such as:

inputs.conf (forwarder)

[WinEventLog://<name>]
index = windows

restart splunk after making the config change

note: make sure you've configured the 'windows' index on the indexers in indexes.conf

0 Karma

ddrillic
Ultra Champion
0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

@m314219 can you run the following from cli on your forwarder and attach the results, pointing out which input is in question.

from $SPLUNK_HOME\bin

.\splunk btool inputs list --debug > inputs.txt

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...