https://community.splunk.com/t5/Deployment-Architecture/Rotuing-data-to-specific-indexes/m-p/373449#M19142 <P>yes My cluster is indexer cluster . and other question is that how does splunk handle creation of indexes?<BR /> like ket say i have multisite indexer cluster where would i create index ?</P> Wed, 28 Jun 2017 16:21:09 GMT aab5272 2017-06-28T16:21:09Z https://community.splunk.com/t5/Deployment-Architecture/Rotuing-data-to-specific-indexes/m-p/373446#M19139 <P>I have situtationn where i have cluster master which managed the indexer cluster . I am getiing data in load balancing way based on autoLBfrequency . Now i want to route data at a particular index , do iahve to make change in props.conf and tansform.conf at the master or at each peer indexer ?</P> Wed, 28 Jun 2017 14:00:21 GMT https://community.splunk.com/t5/Deployment-Architecture/Rotuing-data-to-specific-indexes/m-p/373446#M19139 aab5272 2017-06-28T14:00:21Z https://community.splunk.com/t5/Deployment-Architecture/Rotuing-data-to-specific-indexes/m-p/373447#M19140 <P>On the Cluster Master, the app is in /etc/master-apps right? </P> <P>Change the props, transforms in the relevant app and then push the cluster bundle - ./splunk apply cluster-bundle</P> <P>This will push the new bundle to the cluster members. If you need information on the filtering, please let me know</P> <P>Example on filtering:<BR /> within transforms</P> <P>[index_filter_example]<BR /> REGEX = regex for what you want to match<BR /> FORMAT = index name<BR /> DEST_KEY = _MetaData:Index</P> <P>within props<BR /> [sourcetype]<BR /> TRANSFORMS-index_filters = index_filter_example, .....</P> Tue, 29 Sep 2020 14:36:27 GMT https://community.splunk.com/t5/Deployment-Architecture/Rotuing-data-to-specific-indexes/m-p/373447#M19140 WalshyB 2020-09-29T14:36:27Z https://community.splunk.com/t5/Deployment-Architecture/Rotuing-data-to-specific-indexes/m-p/373448#M19141 <P>Hi aab5272,<BR /> sorry but I don't understand yyour need: are you speaking about forwarding data to indexers and do you want to send data to a clustered index?<BR /> in this case you have only to specify index in your inputs.conf file on forwarders.</P> <P>If instead you want to send logs to a non clustered index that is present in only one Indexer, you have to use selective indexing (see <A href="http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad</A>).</P> <P>Bye.<BR /> Giuseppe</P> Wed, 28 Jun 2017 15:09:19 GMT https://community.splunk.com/t5/Deployment-Architecture/Rotuing-data-to-specific-indexes/m-p/373448#M19141 gcusello 2017-06-28T15:09:19Z https://community.splunk.com/t5/Deployment-Architecture/Rotuing-data-to-specific-indexes/m-p/373449#M19142 <P>yes My cluster is indexer cluster . and other question is that how does splunk handle creation of indexes?<BR /> like ket say i have multisite indexer cluster where would i create index ?</P> Wed, 28 Jun 2017 16:21:09 GMT https://community.splunk.com/t5/Deployment-Architecture/Rotuing-data-to-specific-indexes/m-p/373449#M19142 aab5272 2017-06-28T16:21:09Z https://community.splunk.com/t5/Deployment-Architecture/Rotuing-data-to-specific-indexes/m-p/373450#M19143 <P>In indexers cluster, indexes are created on the master node, otherwise they aren't replicated.<BR /> Bye.<BR /> Giuseppe</P> Thu, 29 Jun 2017 06:50:07 GMT https://community.splunk.com/t5/Deployment-Architecture/Rotuing-data-to-specific-indexes/m-p/373450#M19143 gcusello 2017-06-29T06:50:07Z