The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.

Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.

Forums: SplunkGeneral: Lightforwarder to another Indexer

Previous Topic: Search Results Not Displayed in Outlook?  |   Next Topic: PdhCollectQueryData failed


Posts 1–2 of 2
1
posted by: csoh  |  posts
date: June 14, 2010
permalink

Hi,

I have set the LightForwarder on one of my Windows servers.
How can I set the Splunk server to receive this data and index it as another indexer instead of the "main" index?

Thanks

Cheers,
Chee Siong

2
posted by: rachel  |  posts
date: June 16, 2010
permalink

you can specify the index for any input (include from a forwarder) in inputs.conf.

i recommend reading
http://www.splunk.com/base/Documentation/latest/Admin/Consolidatedatafrommultiplemachines

for some useful information.