topic Re: Routing to index based on host not working in Getting Data In

Routing to index based on host not working

cmlombardo — Thu, 28 Sep 2023 16:33:33 GMT

Hello there.

I have IIS logs being ingested into Splunk.

The sourcetype is currently set to "iis:test"

props.conf:

[iis:test] TZ = UTC TIME_FORMAT = %Y-%m-%d %H:%M:%S TRANSFORMS-8_AssignToIndex = setindex_dev, setindex_qa, setindex_stage, setindex_prod

transforms.conf:

[setindex_dev] SOURCE_KEY = MetaData:Host REGEX = (?i)^host::web-dev-2\d{1}.*$ DEST_KEY = _MetaData:Index FORMAT = wf_dev_i [setindex_qa] SOURCE_KEY = MetaData:Host REGEX = (?i)^host::web-qa-2\d{1}.*$ DEST_KEY = _MetaData:Index FORMAT = wf_qa_i [setindex_stage] SOURCE_KEY = MetaData:Host REGEX = (?i)^host::web-stg-2\d{1}.*$ DEST_KEY = _MetaData:Index FORMAT = wf_stage_i [setindex_prod] SOURCE_KEY = MetaData:Host REGEX = (?i)^host::web-2\d{1}.*$ DEST_KEY = _MetaData:Index FORMAT = wf_prod_i

This should send the events coming from the host web-dev-20 to the wf_dev_i index. Instead, they go to the main index.

I have the same configuration set for other sources and it works fine.

What am I missing here?

Thank you,

Claudio

Re: Routing to index based on host not working

gcusello — Fri, 29 Sep 2023 06:55:31 GMT

Hi @cmlombardo,

where did you located this props and transforms files?

They must be located in the Indexers or, if present in the first Heavy Forwarder they are passing throgh, not on Universal Forwarder.

Ciao.

Giuseppe

Re: Routing to index based on host not working

cmlombardo — Mon, 02 Oct 2023 13:18:55 GMT

Ciao Giuseppe,

props.conf and transforms.conf are on our HFs.

Since my post, I was able to finally find out what happened. The transforms names we chose were already used in other transformations elsewhere. What are the odds? Hilarious.

After checking so many times the syntax and the regexes I decided to take a look at all the transformations in place and found the culprit.

Now that the new transformations have a different name, everything works as expected.

Claudio

Re: Routing to index based on host not working

gcusello — Mon, 02 Oct 2023 13:32:38 GMT

Hi @cmlombardo,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer (also your own) for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Routing to index based on host not working

gcusello — Mon, 02 Oct 2023 13:41:01 GMT

Hi @cmlombardo,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉