topic Re: multiple indexes in distrubuted splunk environment in Getting Data In

multiple indexes in distrubuted splunk environment

ultra — Thu, 30 Sep 2010 09:11:05 GMT

Before I ask my question, this is my environment.

1 forwarder

4 indexers

1 search head

I am trying to setup several indexes (based on source types).

I have created indexes on each of the indexers (ct_usertransaction), and setup rules according to the documentation.

props.conf (on forwarder)
[ct-UserTransaction]
TRANSFORMS-index = ct-UserTransaction


[ct-UserTransaction]
DEST_KEY = MetaData:Index
REGEX = (ct-UserTransaction:)
FORMAT = ct_usertransaction

But I don't see anything in ct_usertransaction index.

Where do I need to configure the rules, on a forwarder or indexers?

Re: multiple indexes in distrubuted splunk environment

Stephen_Sorkin — Thu, 30 Sep 2010 09:39:01 GMT

You need to set this configuration on the indexer for lightweight forwarders and on the forwarder for heavyweight forwarders.

Re: multiple indexes in distrubuted splunk environment

gkanapathy — Thu, 30 Sep 2010 10:41:11 GMT

Please see http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F for a general explanation.

Re: multiple indexes in distrubuted splunk environment

ultra — Fri, 01 Oct 2010 01:33:56 GMT

Thank you very much for this. It is a helpful link.

But it raises another question.
How do I route specific events from a heavy weight forwarder to a specific index on a remote indexer?