How to send data to different index?

sarit_s — Mon, 12 Jun 2023 13:27:18 GMT

Hello

I have some kind of data that I want to filter to different index and in the future i would like to stop this index entirely.

The data I want to filter is

1. all the logs with debug mode

2. logs that contains Categories!="" OR Categories!=$* OR Categories!="* *"

How it can be done ?

Thanks

Re: send data to different index

gcusello — Mon, 12 Jun 2023 12:13:21 GMT

Hi @sarit_s,

at first the rules to have different indexes are two:

different retention times,
different access grants.

In your case I suppose that debug logs have a lower retention than the others.

Anyway, you can address logs to an index in inputs.conf, indicating the destination index in each stanza.

Otherwise, you can override the index value following the instructions that you can find in many answers.

In few words:

you have at first to identify the sourcetype and a regex to select the events to send in a different index, then you have to put

in props.conf

[your_sourcetype] TRANSFORMS-index = overrideindex

and on transforms.conf

[overrideindex] DEST_KEY =_MetaData:Index REGEX = <your_regex> FORMAT = your_new_index

Rememeber that these two conf files must be in the first full Splunk instance you have (not Universal Forwarder), in other words in the first Heavy Forwarder (if present) or on Indexers.

Ciao.

Giuseppe

topic Re: send data to different index in Getting Data In

How to send data to different index?

Re: send data to different index