topic Receiver to certain index in Splunk Dev

Receiver to certain index

FRoth — Sun, 08 Sep 2013 09:38:20 GMT

I'd like to route received data (Receiver) to a certain index. I set an "index" in the "inputs.conf" but this didn't work.

[splunktcp://9997]
connection_host = ip
index = win_native

What I did: I configured a receiver on my splunk server and prepared an index on another partition that has enough space. (Index=win_native)

I would like to route all incoming data on that port (9997) to another index instead of the "main" index. The main index is located on a partition with only 5GB space.

I tried to accomplish this with the following changes but this didn't work neither.

In props.conf

[WinEventlog:Security]
TRANSFORMS-towinnativeindex = winnativeindex

In transforms.conf

[winnativeindex]
REGEX = .*
DEST_KEY = _MetaData:Index
FORMAT = win_native

Any ideas?

Re: Receiver to certain index

rsennett_splunk — Mon, 09 Sep 2013 03:42:56 GMT

When you say "it didn't work". Do you mean that cooked data came in on port 9997 and was indexed into the main index?

Is it possible that you have another inputs.conf with a similar declaration declaring index=main deliberately somewhere? You shouldn't really need the props and transforms in this case if you want everything coming on that port to go to the one index.

Re: Receiver to certain index

kristian_kolb — Mon, 09 Sep 2013 05:13:10 GMT

It's better to set it up at source, so-to-speak, i.e. in inputs.conf on the forwarder;

[WinEventLog:Security] disabled=0 index=win_native

Just ensure that the index exists on the receiving end, i.e. the indexer.

Re: Receiver to certain index

rsennett_splunk — Mon, 09 Sep 2013 05:45:08 GMT

good point...

Re: Receiver to certain index

FRoth — Mon, 09 Sep 2013 10:03:30 GMT

Ahhhh - I missed a "typo" in the sourcetype. "WinEventlog" has to be "WinEventLog" with an uppercase "L". Now I use [source::WinEventLog...] as stanza and the transforms are applied.