Estreamer index goes into main how to change it...

[darkwall]

Hi,

By default if we do nothing eStreamer eNcore data and information goes directly into the main index

How can i change that in a cluster environnement.

Thanks

[rhoadesjon]

I am not a splunk expert. I am sure there is a slicker / better way to do it but this works for me. I did this on my heavy forwarder that feeds an index cluster.

I copied this from
/opt/splunk/etc/apps/TA-eStreamer/default/inputs.conf

Where data is written to
[monitor://$SPLUNK_HOME/etc/apps/TA-eStreamer/data]
disabled = 0
source = encore
sourcetype = cisco:estreamer:data
crcSalt =

I added this to /opt/splunk/etc/apps/TA-eStreamer/local/inputs.conf to overide the default
[monitor://$SPLUNK_HOME/etc/apps/TA-eStreamer/data]
disabled = 0
source = encore
sourcetype = cisco:estreamer:data
crcSalt =
index = cisco

My cisco:estreamer:data is now going to index cisco instead of index main