https://community.splunk.com/t5/Getting-Data-In/UDP-syslog-seprate-index-for-specific-hosts/m-p/54174#M10469 <P>I've got something similar working where I'm sending specific type syslog msg to a separate index. In my case I'm specifying [syslog] in my props.conf and then doing a regex match for the msg I want in the transforms.conf.</P> <P>If you're only sending syslog msgs from the host you want, you can probably filter on the host itself to send all msgs to the separate index. Something like the below (I haven't tested this btw)</P> <P>props.conf<BR /><BR /> [host::somehost]<BR /><BR /> TRANSFORMS-syslog-somehost=SYSLOGSOMEHOST</P> <P>transforms.conf<BR /><BR /> [SYSLOGSOMEHOST]<BR /><BR /> REGEX =(.*)<BR /><BR /> DEST_KEY = _MetaData:Index<BR /><BR /> FORMAT = YOURINDEX<BR /><BR /> WRITE_META = true</P> Mon, 02 May 2011 19:37:07 GMT briang67 2011-05-02T19:37:07Z https://community.splunk.com/t5/Getting-Data-In/UDP-syslog-seprate-index-for-specific-hosts/m-p/54173#M10468 <P>Hey Guys,</P> <P>I have multiple host in my network using UDP:514 syslog to main index in splunk but now i want to create separate "production" index for critical server. so how should i divert syslog traffic to new index ? I read on google people talking about props.conf but how it will work ? </P> Sat, 05 Mar 2011 02:20:44 GMT https://community.splunk.com/t5/Getting-Data-In/UDP-syslog-seprate-index-for-specific-hosts/m-p/54173#M10468 satishp 2011-03-05T02:20:44Z https://community.splunk.com/t5/Getting-Data-In/UDP-syslog-seprate-index-for-specific-hosts/m-p/54174#M10469 <P>I've got something similar working where I'm sending specific type syslog msg to a separate index. In my case I'm specifying [syslog] in my props.conf and then doing a regex match for the msg I want in the transforms.conf.</P> <P>If you're only sending syslog msgs from the host you want, you can probably filter on the host itself to send all msgs to the separate index. Something like the below (I haven't tested this btw)</P> <P>props.conf<BR /><BR /> [host::somehost]<BR /><BR /> TRANSFORMS-syslog-somehost=SYSLOGSOMEHOST</P> <P>transforms.conf<BR /><BR /> [SYSLOGSOMEHOST]<BR /><BR /> REGEX =(.*)<BR /><BR /> DEST_KEY = _MetaData:Index<BR /><BR /> FORMAT = YOURINDEX<BR /><BR /> WRITE_META = true</P> Mon, 02 May 2011 19:37:07 GMT https://community.splunk.com/t5/Getting-Data-In/UDP-syslog-seprate-index-for-specific-hosts/m-p/54174#M10469 briang67 2011-05-02T19:37:07Z