After upgrading universal forwarders, data is sent to the wrong indexes

Applicability

Description

There are 2 sets of indexes for homing data from Windows machines. One set used for servers (epintel, oswin, oswinperf, oswinscript, oswinsec) and one set used for endpoints (epintel_ep, oswin_ep, oswinperf_ep, oswinscript_ep, oswinsec_ep). The difference being that the endpoint indexes have a retention period of only 6 months.

After updating Universal Forwarders they start sending data to the server indexes (epintel, oswin, oswinperf, oswinscript, oswinsec) instead of the endpoint indexes (epintel_ep, oswin_ep, oswinperf_ep, oswinscript_ep, oswinsec_ep).

Investigation

1.  Check the inputs.conf with the path $SPLUNK_HOME/etc/apps

2. Look differences between configuration files within the 2 apps defining the routing of the indexes.
Example:
Currently working UF (host="UF_1"):

etc/apps/app_name/local/inputs.conf       [stanza name]
etc/apps/app_name/local/inputs.conf       index = test_ep

Currently not working UF (host="UF_2" ):

etc/apps/app_name/local/inputs.conf       [stanza name]
etc/apps/app_name/local/inputs.conf       index = test

Resolution

Related Links