topic Re: How to route the logs from certain host to index=abc_secure? in Getting Data In

How to route the logs from certain host to index=abc_secure?

VijaySrrie — Wed, 02 Nov 2022 02:41:33 GMT

Hi Team,

[host::1.(xx|xx).xx.xx(x|y)]
TRANSFORMS-change_index_abc_secure = change_index_abc_secure

[change_index_abc_secure]
SOURCE_KEY = MetaData:Index
REGEX = os, os_secure
DEST_KEY = MetaData:Index
FORMAT = index::abc_secure

I need to route the logs from certain host to index=abc_secure (not all the logs only os and os_secure logs)

Re: How to route the logs from certain host to index=abc_secure?

gcusello — Wed, 02 Nov 2022 07:48:32 GMT

Hi @VijaySrrie,

if you want to redirect only logs where index contains os or os_secure you have to use a different regex:

[change_index_abc_secure] SOURCE_KEY = MetaData:Index REGEX = os|os_secure DEST_KEY = MetaData:Index FORMAT = index::abc_secure

Ciao.

Giuseppe

Re: How to route the logs from certain host to index=abc_secure?

VijaySrrie — Thu, 03 Nov 2022 23:44:56 GMT

Hi @gcusello

Yes, this is fine, also I want the logs only from the hostname LIANS*

Will the below props and transforms work?

props.conf

[host=LIANS*]
TRANSFORMS-change_index_abc_secure = change_index_abc_secure

transforms.conf

[change_index_abc_secure]
SOURCE_KEY = MetaData:Index
REGEX = os|os_secure
DEST_KEY = MetaData:Index
FORMAT = index::abc_secure

Re: How to route the logs from certain host to index=abc_secure?

gcusello — Fri, 04 Nov 2022 07:27:25 GMT

Hi @VijaySrrie,

yes it's correct, test it and tell me the result.

Ciao.

Giuseppe

Re: How to route the logs from certain host to index=abc_secure?

VijaySrrie — Mon, 07 Nov 2022 07:02:22 GMT

Hi @gcusello

This isn't working
Not sure where am I going wrong

Re: How to route the logs from certain host to index=abc_secure?

gcusello — Mon, 07 Nov 2022 07:14:04 GMT

Hi @VijaySrrie,

please try this props.conf

[host::LIANS*] TRANSFORMS-change_index_abc_secure = change_index_abc_secure

even if I'm not sure that's possible to use the asterisk in props.conf , could you try using a sourcetype instead host?

Ciao.

Giuseppe

Re: How to route the logs from certain host to index=abc_secure?

VijaySrrie — Fri, 25 Nov 2022 02:04:00 GMT

@gcusello

Below config worked

Props

[host::LIANS*]
TRANSFORMS-change_index_abc_secure = change_index_abc_secure

Transforms.conf

[change_index_abc_secure]
SOURCE_KEY = _MetaData:Index
REGEX = os|os_secure
DEST_KEY = _MetaData:Index
FORMAT = abc_secure

Re: How to route the logs from certain host to index=abc_secure?

gcusello — Fri, 25 Nov 2022 08:18:04 GMT

Hi @VijaySrrie,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉