topic Re: How to make transforms.conf to pick from the default group of outputs.conf in Getting Data In

How to make transforms.conf to pick from the default group of outputs.conf

premg — Mon, 28 Sep 2020 16:17:09 GMT

Hi,

We need to forward all events to indexer group_A and filtered events to indexer group_B.

We are applying some transformations on a data.
We are forwarding this data in such a way that the data with transformations are sent to server 'A' and the data without transformations are sent to server 'B'.

The props, transforms and outputs are given as follows.

props.conf

[sourcetype]
TRANSFORMS-routing=routeAllEvents,routeFilteredEvents

transforms.conf

[routeAllEvents]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=indexers_group_A

[routeFilteredEvents]
REGEX=(some_filter)
DEST_KEY=_TCP_ROUTING
FORMAT=indexers_group_A,indexers_group_B

outputs.conf

[tcpout]
forwardedindex.filter.disable=true
defaultGroup=indexers_group_A

[tcpout:indexers_group_A]
server=server1:9997
disabled=false
autoLB=true

[tcpout:indexers_group_B]
server=server2:9997
disabled=false
autoLB=true

[tcpout:indexers_group_C]
server=server3:9997
disabled=false
autoLB=true

This works fine.

Question:

If I want to forward all events (default group) to Indexers_group_C instead of indexer_group_A, I had to change in both outputs.conf and transforms.conf.
Is there any way to make transforms.conf to pick from the default group of outputs.conf?

Re: How to make transforms.conf to pick from the default group of outputs.conf

MuS — Tue, 01 Apr 2014 11:08:26 GMT

Hi premg,

Basically you set a default destination for your data in transforms.conf and/or in outputs.conf. If you want to manage default destinations in one .conf file, do it in transforms.conf, because _TCP_ROUTING from transforms.conf will overwrite the outputs.conf defaultGroup stanza.

hope this helps ...

cheers, MuS

Re: How to make transforms.conf to pick from the default group of outputs.conf

premg — Thu, 03 Apr 2014 07:39:06 GMT

Many thanks MuS.
I'll leave [routeAllEvents].
However, how do Splunk pick up default group in [routeFilteredEvents] stanza?

Re: How to make transforms.conf to pick from the default group of outputs.conf

MuS — Thu, 03 Apr 2014 07:52:06 GMT

ok, now I got your point. There is no link and _TCP_ROUTING from transforms.conf will over write defaultGroup in outputs.conf. If you want to manage default groups in one single file, stick to the transforms.conf and configure everything in there.

Re: How to make transforms.conf to pick from the default group of outputs.conf

MuS — Thu, 03 Apr 2014 07:55:46 GMT

update ping