Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Deployment Server - sending data to a 'specific index'

$
0
0
Hi all, Just need help understanding deployment servers better and how you are able to forwarder data to a 'specific index' My current setp: - 1 index master ( a 'test' index has been configured and 'pushed' to the peer nodes successfully) - 2 index peers - 2 UF - 1 Deployment server ( Clients successfully peered and forward management is working fine) What I am confused about is when I access the deployment server and - select 'add data' - I then select the available host ( and select both my UF) - I then create a new server class called Linux UF - I then select source /var/log - Now I come to the option where I select the 'Index'.... This is were my confusion is as the 'test' indexes I have successfully created with the master are not showing! I just want to be able to send my var/log LOGS to the 'test' index. Does this mean I need to manual update the inputs.conf to include index = test. If possible could you please help list the required steps to help give me a better understanding as right now Im condusin myself to much. much appreciated and thank you!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>