how to assign data to an index?

[vnguyen46]

I have data from different sources already forwarded to a forwarders. Indexes already created on a deployment-master combined server, next how can I assign the data per source to a desired index?

Thanks,

[vnguyen46]

Excellent information - thank you everyone.

[woodcock · Accepted solution]

If you created an app in the deployment-apps directory on your Deployment Server and it has an inputs.conf that defines index values, you still have to deploy this app to your indexers by creating a serverclass inside of $SPLUNK_HOME/etc/system/local/serverclass.conf and add a whitelist setting to this serverclass that contains the identities of your indexers. Then add the app that you created to the serverclass. Then restart the Deployment Server and let the magic happen.

[Anantha123]

Go through this document.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles

Thanks,

[vnguyen46]

Do I need to update these .conf files on the deployment server or other instances?

Thanks,

[iamsplunker31]

Hi @vnguyen46 , You need to update the indexes.conf in ClusterMaster and push it to indexers and inputs.conf on Deployment server push it to forwarders
Update serverclass.conf in DS(Deployment Server)
props.conf is not mandatory

[Anantha123]

You have to update in index.conf ,input.conf ,props.conf, serverclass.conf files to assign data to desired index.

Thanks
Anantha.