https://community.splunk.com/t5/Getting-Data-In/Need-help-with-redirecting-index/m-p/80625#M16632 <P>Currently our Sun systems dump all of their authentication logs to the syslog sourcetype. </P> <P>I want to pull those "auth" entries out of there and put them into a different index I have setup called unix_secure<BR /><BR /> I have the following files in /opt/splunk/etc/system/local on one of my forwarder systems but it is not working. </P> <P>Any thoughts?</P> <P><STRONG>props.conf</STRONG><BR /><BR /> [syslog]<BR /><BR /> TRANSFORMS-index = AuthRedirect</P> <P><STRONG>transforms.conf</STRONG><BR /><BR /> [AuthRedirect]<BR /><BR /> REGEX = auth.<BR /><BR /> DEST_KEY = _MetaData:Index<BR /><BR /> FORMAT = unix_secure</P> Mon, 28 Sep 2020 11:27:25 GMT moshman 2020-09-28T11:27:25Z https://community.splunk.com/t5/Getting-Data-In/Need-help-with-redirecting-index/m-p/80625#M16632 <P>Currently our Sun systems dump all of their authentication logs to the syslog sourcetype. </P> <P>I want to pull those "auth" entries out of there and put them into a different index I have setup called unix_secure<BR /><BR /> I have the following files in /opt/splunk/etc/system/local on one of my forwarder systems but it is not working. </P> <P>Any thoughts?</P> <P><STRONG>props.conf</STRONG><BR /><BR /> [syslog]<BR /><BR /> TRANSFORMS-index = AuthRedirect</P> <P><STRONG>transforms.conf</STRONG><BR /><BR /> [AuthRedirect]<BR /><BR /> REGEX = auth.<BR /><BR /> DEST_KEY = _MetaData:Index<BR /><BR /> FORMAT = unix_secure</P> Mon, 28 Sep 2020 11:27:25 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-with-redirecting-index/m-p/80625#M16632 moshman 2020-09-28T11:27:25Z https://community.splunk.com/t5/Getting-Data-In/Need-help-with-redirecting-index/m-p/80626#M16633 <P>This configuration needs to be put into place where the data is parsed, which usually means you'd use it on an indexer. In the case of a forwarder, it will only work on a heavy forwarder. On a LWF/UF, this wouldn't work at all, as almost nothing is parsed on these instances. </P> Tue, 28 Feb 2012 17:49:01 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-with-redirecting-index/m-p/80626#M16633 jbsplunk 2012-02-28T17:49:01Z https://community.splunk.com/t5/Getting-Data-In/Need-help-with-redirecting-index/m-p/80627#M16634 <P>Thanks jbsplunk - worked like a charm!</P> Tue, 28 Feb 2012 18:35:24 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-with-redirecting-index/m-p/80627#M16634 moshman 2012-02-28T18:35:24Z https://community.splunk.com/t5/Getting-Data-In/Need-help-with-redirecting-index/m-p/80628#M16635 <P>Glad to help! If you found this useful, please feel free to accept and upvote the answer.</P> Tue, 28 Feb 2012 18:36:50 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-with-redirecting-index/m-p/80628#M16635 jbsplunk 2012-02-28T18:36:50Z