topic Re: How to assign syslog file to specific index based on file name in transforms.conf? in Getting Data In

How to assign syslog file to specific index based on file name in transforms.conf?

dhavamanis — Wed, 30 Jul 2014 17:58:02 GMT

Can you please provide sample configuration for the below, We have multiple forwarding sources and they are using syslog-ng. how to assign index based on log filename at indexer side.

Example :

mynbc-syslog-2015-07-30.log pattern files to go "mynbc" index
msnbc-syslog-2015-07-29.log patter files to go "msnbc" index
bravotv-syslog-2015-08-01_1.log patter files to go "bravotv" index

Re: How to assign syslog file to specific index based on file name in transforms.conf?

strive — Wed, 30 Jul 2014 20:18:37 GMT

Check this
http://answers.splunk.com/answers/38547/sending-certain-logs-from-udp-port-514-to-specific-indexes

Re: How to assign syslog file to specific index based on file name in transforms.conf?

dhavamanis — Fri, 01 Aug 2014 14:47:47 GMT

Can you please provide the sample REGEX while using the the file name pattern like this ${sitename}.${logname} ${Existing MSG}. we want to parse the sitename and assign to index name.

Re: How to assign syslog file to specific index based on file name in transforms.conf?

dhavamanis — Mon, 28 Sep 2020 17:14:40 GMT

trying with the below config, seems its not working for me, Can you please correct this if anything wrong,

props.conf

[syslog]
TRANSFORMS-idx_routing = generic_idx_routing

transforms.conf (created index abc)

[generic_idx_routing]
SOURCE_KEY = MetaData:Host
REGEX = abc.xyz.\nbcu.com
DEST_KEY = _MetaData:Index
FORMAT = $1

inputs.conf

[splunktcp-ssl:9997]
compressed = true
sourcetype = syslog

[SSL]
password = password
requireClientCert = false
rootCA = $SPLUNK_HOME/etc/certs/cacert.pem
serverCert = $SPLUNK_HOME/etc/certs/splunknode.pem

Re: How to assign syslog file to specific index based on file name in transforms.conf?

dhavamanis — Mon, 28 Sep 2020 17:14:43 GMT

Forwarder- outputs.conf

[tcpout:splunkssl]
server = splunk.abc.com:9997
compressed = true

[tcpout-server://splunk.abc.com:9997]
sslCertPath = $SPLUNK_HOME/etc/certs/forwarder.pem
sslPassword = password
sslRootCAPath = $SPLUNK_HOME/etc/certs/cacert.pem

Re: How to assign syslog file to specific index based on file name in transforms.conf?

martin_mueller — Fri, 01 Aug 2014 21:12:10 GMT

Filename-based transforms.conf use the source key from the metadata like this:

[send_to_index_by_source]
SOURCE_KEY = MetaData:Source
REGEX = ^source::/path/to/files/(\w+)-syslog
DEST_KEY = _MetaData:Index
FORMAT = $1

Reference that in props.conf with TRANSFORMS-foo = send_to_index_by_source.