Forwarder works properly on initial install. Event logs are successfully exported into Splunk, but end up in the main index.
I modified inputs.conf and added
[default]
index = otherindex
After that, no data is transmitted. I know that the index is there as it is successfully displaying data that is coming in from our Linux hosts. I also tried simply adding index = otherindex under each type of Eventlog with the same results.
Maybe there is some kind of permission that is blocking these Windows hosts from writing to that index? (I'm not the Splunk admin so I don't know what's possible -- I'm merely deploying the client)
I'm going to assume there was a bug in the last version -- I downloaded the latest Forwarder and it works as expected now.
Some basic tips which you'd need to clarify if you've tried first;
index=otherindex
in a search
window? By default you won't
probably be searching this index
when you run searches unless its
been added to your role.I haven't. I only have access to the hosts on which I'm installing the forwarder. I can however make a suggestion to the Splunk admin if we narrow things down. Is there some kind of syntax that can be set to specifically send Windows Eventlogs going to main to another index?
I forgot to mention that I've done this on a couple Windows servers and the behavior is the same on each.
Have you tried setting the index= on the indexer side?
Yep. Every time I made a change to any of the conf files I restarted the SplunkForwarder Service.
By searching.
I confirmed that I can do index=existingindex and it'll show things coming in.
I also confirmed that if I do host=windowshost it'll show things coming into main pretty much constantly, and stops when I add the index = line to inputs.conf.
It's an odd problem! I swear I'm doing everything by the docs.