Hi All, Having an issue trying to route events to an index by source, posting as a new question as I've not found anything that's helped me understand how /where to configure this. We have events being streamed to HEC (Token) hosted on a HF, which is then forwarding the events to an Indexer, all events are ending up in the Main index on the Indexer. How can events of the default field Source 'xyz' be sent to a specific Indexer Index 'index_xyz'? I've seen numerous posts about routing to a specific Index using the SourceType but not Source. I know props.conf and transforms.conf are needed but I've not seen any examples for using Source, also I'm unsure whether they should be implemented on the HF or the Indexer... The resoning for using Source for routing to a specific index is that these events are always lsted as the Token Name 'xyz'. TIA Daniel ... View more

Hi all, What would be a simply approach to creating an alert based on the following log data: The objective is to send an alert if the "Return Code" does not equal the number "1" # Reporting Started # ##################### # Processing task 1 # Processing task 2 # Processing task 3 ##################### # Return Code 1 TIA     ... View more

Hi, Selecting Windows IIS logs (C:\inetpub\logs\LogFiles\W3SVC) as event source during the installation of Universal Forwarder (splunkforwarder-6.5.1-f74036626f0c-x64-release.msi) resulted in data/events being forwarded to the Index (as expected), but I cannot find any entries in (C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf) to show for this selection I made during the installation. Where are the config details stored when specifying during the UF Installation? TIA Danny ... View more