topic Re: Syslog data going to lastchanceindex in Getting Data In

Syslog data going to lastchanceindex

Dominic32 — Fri, 27 Oct 2023 22:54:25 GMT

I added a new syslog source using upd port 514. The data is being ingested into "lastchanceindex". How can I find out what index splunk "wants" to put the data into, so that I can create that index? Or how can I specify an index without disrupting the other syslog data sources?

We use udp://514 for many different syslog data sources, so specifying all of it to go to one index wouldn't work.

Re: Syslog data going to lastchanceindex

enzomialich — Fri, 27 Oct 2023 23:41:43 GMT

IMO you should use a HF for this.

HF will route data based on its contents. So if a log comes with something "trend micro" send to a specific index.

It will be something like this: Solved: How do I route data to specific index based on a f... - Splunk Community

Re: Syslog data going to lastchanceindex

Dominic32 — Fri, 27 Oct 2023 23:44:12 GMT

We are using 2 load balanced HFs for this.

Re: Syslog data going to lastchanceindex

Dominic32 — Fri, 27 Oct 2023 23:47:03 GMT

I was able to resolve the issue. in the _internal index, the following events were generated. I used this to determine which index Splunk wanted to sort the events into, and created it.

Search peer mysplunkidxs.splunkcloud.com has the following message: Redirected event for unconfigured/disabled/deleted index=intended_index with source="source::1234" host="host::abc" sourcetype="sourcetype::456:efg" into the LastChanceIndex. So far received events from 1 missing index(es).