topic Windows EventLogs in Deployment Architecture

Windows EventLogs

mileven — Mon, 30 Dec 2013 17:25:32 GMT

Is it possible to send specific EventCodes to a different index other than the specified index. I want to send some application specific EventCodes to an application specific index that is not the default EventLog index.

For example.

EventCode 1-1000 goto index A
EventCode 10000-11000 go to index b

Is this possible?

Re: Windows EventLogs

aelliott — Mon, 30 Dec 2013 17:29:09 GMT

perhaps this post may assist you:
http://answers.splunk.com/answers/27781/distribute-data-from-one-source-to-different-indexes

Re: Windows EventLogs

aelliott — Mon, 30 Dec 2013 17:33:03 GMT

also see the part that says "Route specific events to a different index" here: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes

Re: Windows EventLogs

Adrian — Sat, 04 Jan 2014 21:44:59 GMT

To answer your question... Yes, it is possible. This is the documentation you require: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes#Route\_specific\_events\_to\_a\_different_index

You would have to modify your REGEX statement in your transforms.conf to grab the events you require:

   [<transforms_A>]
    REGEX = EventCode:([0-9]{1,3}|1000)
    DEST_KEY = _MetaData:Index
    FORMAT = indexA

    [<transforms_B>]
    REGEX = EventCode:1(0[0-9]{3}|1000)
    DEST_KEY = _MetaData:Index
    FORMAT = indexB

You might have to play around with the regex statements provided in example