topic Re: Split syslog input into multiple indexes in Getting Data In

Split syslog input into multiple indexes

hollow — Fri, 05 Oct 2012 10:20:24 GMT

I'm trying to split messages that come into splunk via UDP:514 (single input, single sourcetype) into multiple indexes based on a regex that should be applied to the _raw message.

I've tried several suggestions i've found in splunk-base but nothing seems to work 😞

My current configuration looks like this:

inputs.conf

[tcp://8514]
connection_host = ip
sourcetype = syslog

props.conf

[syslog]
TRANSFORMS-index=route-to-index

transforms.conf

[route-to-index]
REGEX = ^<\d+>(app|pubsub|updater)(?:\[(\d+)\])?:\s
FORMAT = index::myindex
WRITE_META = true

The inputs.conf is in etc/system/local/inputs.conf, props and transforms are in a custom app.

The goal is to filter based on the process name for now. The regex definitely matches the messages, but nothing appears in myindex.

Re: Split syslog input into multiple indexes

dart — Mon, 08 Oct 2012 14:30:45 GMT

You're pretty close. In your

transforms.conf

[route-to-index]
REGEX = ^<\d+>(app|pubsub|updater)(?:\[(\d+)\])?:\s
FORMAT = myindex
DEST_KEY = _MetaData:Index

Should do the trick.

Re: Split syslog input into multiple indexes

hollow — Mon, 29 Oct 2012 07:48:14 GMT

i could swear that i also had this variant in my configs before. but it seems to work now, thanks a lot! 🙂

Re: Split syslog input into multiple indexes

zugji — Tue, 18 Apr 2017 06:35:39 GMT

Is this sill working if in inputs.conf an index is defined?
Let's say:

index = main