topic Route Syslogs coming from certain hosts into a separate index in Getting Data In

Route Syslogs coming from certain hosts into a separate index

yahsiel2004 — Tue, 16 Jul 2013 20:03:56 GMT

I've been attempting to route Syslog messages, coming from certain hosts, to a separate index with no success. Below is an example of my config:

Splunk\etc\system\local\

Props.conf
[syslog]
TRANSFORMS-index = test

Transforms.conf
[test]
REGEX = *
FORMAT = myindex
DEST_KEY = _MetaData:Index

yahsiel2004 — Tue, 16 Jul 2013 20:16:44 GMT

Corrections to the Transforms.conf

[test]
REGEX = host=192.168.0.1
FORMAT = myindex
DEST_KEY = _MetaData:Index

adrianathome — Wed, 17 Jul 2013 01:55:10 GMT

In inputs.conf

[udp://10.1.1.5:514]

Index=myindex

yahsiel2004 — Wed, 17 Jul 2013 12:32:19 GMT

That also didn't work

grijhwani — Wed, 17 Jul 2013 14:07:15 GMT

"*" is not a valid regex. You need ".*".

yahsiel2004 — Wed, 17 Jul 2013 16:25:32 GMT

Thanks that definitely made a difference 🙂