Hello splunkers ,
I have seen in system/local/inputs.conf of many servers that it contains one entry provided below
root@abchost:~ # `cat /opt/splunkforwarder/etc/system/local/inputs.conf`
[default]
host = abc.com
index = unmanaged
What is need of providing `index= unmanged` in that .
I am just simply guessing that might be it provided the default index entry to those monitors which don't have index name specified ,
Please let me know if i am right or wrong , if wrong then please let me know what is the need of providing that value .
↧