<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: route data to indexes based on fields in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/route-data-to-indexes-based-on-fields/m-p/144328#M29475</link>
    <description>&lt;P&gt;First and most important - &lt;CODE&gt;Department&lt;/CODE&gt; should &lt;EM&gt;not&lt;/EM&gt; be an indexed field. Remove the entry from &lt;CODE&gt;fields.conf&lt;/CODE&gt;&lt;BR /&gt;&lt;BR /&gt;
Second, you need to be very careful with your spelling. I notice that you have misstyped &lt;CODE&gt;TRANSFORMS&lt;/CODE&gt; in several places. &lt;/P&gt;

&lt;P&gt;Finally, try replacing your &lt;CODE&gt;transforms.conf&lt;/CODE&gt; with this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[Department]
SOURCE_KEY = _raw
DEST_KEY   = _MetaData:Index
REGEX      = (?m)\&amp;lt;Department\&amp;gt;(Department1|Department2|Department3)\&amp;lt;/Department\&amp;gt;
FORMAT     = $1
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;And your &lt;CODE&gt;props.conf&lt;/CODE&gt; would have&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[abc]
BREAK_ONLY_BEFORE = \&amp;lt;address&amp;gt;
KV_MODE=XML
SHOULD_LINEMERGE = true
TRANSFORMS-route = Department
pulldown_type = 1
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Note that this will &lt;EM&gt;only&lt;/EM&gt; work if the name of the department is the name of the index, as you showed in your example.&lt;BR /&gt;
If the name of the index is not the same, then you would once again have to have 3 TRANSFORMS stanzas - the difference would be in the FORMAT.&lt;/P&gt;

&lt;P&gt;HTH!&lt;/P&gt;</description>
    <pubDate>Sun, 27 Apr 2014 20:13:37 GMT</pubDate>
    <dc:creator>lguinn2</dc:creator>
    <dc:date>2014-04-27T20:13:37Z</dc:date>
    <item>
      <title>route data to indexes based on fields</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/route-data-to-indexes-based-on-fields/m-p/144327#M29474</link>
      <description>&lt;P&gt;I have xml data which I want to route to different indexes based on the value of "Department" field.&lt;BR /&gt;
Pasted below is the sample file and configurations that I am using..&lt;/P&gt;

&lt;P&gt;Despite the configs, data keeps going to main index.&lt;BR /&gt;
First I index field Department and then route data to indexes based on this field&lt;/P&gt;

&lt;P&gt;Sample file:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;?xml version="1.0" encoding="UTF-8"?&amp;gt;
&amp;lt;addresses&amp;gt;

  &amp;lt;address&amp;gt;
  &amp;lt;LogTime&amp;gt;02/22/2014 07:15:49 AM&amp;lt;/LogTime&amp;gt;
&amp;lt;EventType&amp;gt;TRACE&amp;lt;/EventType&amp;gt;
&amp;lt;Department&amp;gt;Department1&amp;lt;/Department&amp;gt;
    &amp;lt;name&amp;gt;Joe Tester&amp;lt;/name&amp;gt;
    &amp;lt;street&amp;gt;Baker street 5&amp;lt;/street&amp;gt;
  &amp;lt;/address&amp;gt;
   &amp;lt;address&amp;gt;
  &amp;lt;LogTime&amp;gt;02/22/2014 08:15:49 AM&amp;lt;/LogTime&amp;gt;
&amp;lt;EventType&amp;gt;TRACE&amp;lt;/EventType&amp;gt;
&amp;lt;Department&amp;gt;Department2&amp;lt;/Department&amp;gt;
    &amp;lt;name&amp;gt;Joe Tester&amp;lt;/name&amp;gt;
    &amp;lt;street&amp;gt;Baker street 5&amp;lt;/street&amp;gt;
       &amp;lt;/address&amp;gt; 
   &amp;lt;address&amp;gt;
  &amp;lt;LogTime&amp;gt;02/22/2014 09:15:49 AM&amp;lt;/LogTime&amp;gt;
&amp;lt;EventType&amp;gt;TRACE&amp;lt;/EventType&amp;gt;
&amp;lt;Department&amp;gt;Department3&amp;lt;/Department&amp;gt;
    &amp;lt;name&amp;gt;Joe Tester&amp;lt;/name&amp;gt;
    &amp;lt;street&amp;gt;Baker street 5&amp;lt;/street&amp;gt;
      &amp;lt;/address&amp;gt;
&amp;lt;/addresses&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;props.conf&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[abc]
BREAK_ONLY_BEFORE = &amp;lt;address&amp;gt;
KV_MODE=XML
SHOULD_LINEMERGE = true
TRANSFROMS-identifyfields = Department
TRANSFORMS-route = Department1,Department2,Department3
pulldown_type = 1
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;transfroms.conf&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[Department]
REGEX = (Department&amp;gt;(?&amp;lt;Department&amp;gt;)&amp;lt;.Department&amp;gt;)
WRITE_META = true
FORMAT = Department:$1

[Department1]
SOURCE_KEY = field:Department
DEST_KEY   = _MetaData:Index
REGEX      = Department1
FORMAT     = Department1

[Department2]
DEST_KEY   = MetaData:Index
REGEX      = (Department&amp;gt;(?&amp;lt;Department&amp;gt;)&amp;lt;.Department&amp;gt;)
FORMAT     = index:$1

[Department3]
SOURCE_KEY = field:Department
DEST_KEY   = MetaData:Index
REGEX      = Department3
FORMAT     = Department3
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;fields.conf&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[Department]
INDEXED = True
INDEXED_VALUE = False
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Please help&lt;/P&gt;</description>
      <pubDate>Sun, 27 Apr 2014 20:00:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/route-data-to-indexes-based-on-fields/m-p/144327#M29474</guid>
      <dc:creator>kittu26</dc:creator>
      <dc:date>2014-04-27T20:00:09Z</dc:date>
    </item>
    <item>
      <title>Re: route data to indexes based on fields</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/route-data-to-indexes-based-on-fields/m-p/144328#M29475</link>
      <description>&lt;P&gt;First and most important - &lt;CODE&gt;Department&lt;/CODE&gt; should &lt;EM&gt;not&lt;/EM&gt; be an indexed field. Remove the entry from &lt;CODE&gt;fields.conf&lt;/CODE&gt;&lt;BR /&gt;&lt;BR /&gt;
Second, you need to be very careful with your spelling. I notice that you have misstyped &lt;CODE&gt;TRANSFORMS&lt;/CODE&gt; in several places. &lt;/P&gt;

&lt;P&gt;Finally, try replacing your &lt;CODE&gt;transforms.conf&lt;/CODE&gt; with this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[Department]
SOURCE_KEY = _raw
DEST_KEY   = _MetaData:Index
REGEX      = (?m)\&amp;lt;Department\&amp;gt;(Department1|Department2|Department3)\&amp;lt;/Department\&amp;gt;
FORMAT     = $1
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;And your &lt;CODE&gt;props.conf&lt;/CODE&gt; would have&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[abc]
BREAK_ONLY_BEFORE = \&amp;lt;address&amp;gt;
KV_MODE=XML
SHOULD_LINEMERGE = true
TRANSFORMS-route = Department
pulldown_type = 1
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Note that this will &lt;EM&gt;only&lt;/EM&gt; work if the name of the department is the name of the index, as you showed in your example.&lt;BR /&gt;
If the name of the index is not the same, then you would once again have to have 3 TRANSFORMS stanzas - the difference would be in the FORMAT.&lt;/P&gt;

&lt;P&gt;HTH!&lt;/P&gt;</description>
      <pubDate>Sun, 27 Apr 2014 20:13:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/route-data-to-indexes-based-on-fields/m-p/144328#M29475</guid>
      <dc:creator>lguinn2</dc:creator>
      <dc:date>2014-04-27T20:13:37Z</dc:date>
    </item>
  </channel>
</rss>

