https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-from-the-same-log-into-different-indexes/m-p/197486#M39233 <P>I have logs that contains different customer IDs. I am intending to split different events from this log into different Splunk indexes based on the customer ID.</P> <P>There are hundreds of customer IDs, with new ones added frequently.</P> <P>I'm thinking of creating a lookup with customer ID and index to achieve this. I know I can use props and transforms to route events based on a regex, but is this possible to include a lookup here too?</P> <P>It would also be good if I could set a default index should the lookup fail.</P> <P>Can anyone give any advice on how they have (or would) approach and execute something like this. </P> Thu, 22 Jan 2015 15:54:46 GMT himynamesdave 2015-01-22T15:54:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-from-the-same-log-into-different-indexes/m-p/197486#M39233 <P>I have logs that contains different customer IDs. I am intending to split different events from this log into different Splunk indexes based on the customer ID.</P> <P>There are hundreds of customer IDs, with new ones added frequently.</P> <P>I'm thinking of creating a lookup with customer ID and index to achieve this. I know I can use props and transforms to route events based on a regex, but is this possible to include a lookup here too?</P> <P>It would also be good if I could set a default index should the lookup fail.</P> <P>Can anyone give any advice on how they have (or would) approach and execute something like this. </P> Thu, 22 Jan 2015 15:54:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-from-the-same-log-into-different-indexes/m-p/197486#M39233 himynamesdave 2015-01-22T15:54:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-from-the-same-log-into-different-indexes/m-p/197487#M39234 <P>You can't do lookups at index time - they are only at search time.</P> <P>You could probably, with some tweaking, index into a temporary index, then use a search with a lookup and the collect command, to re-index into new indexes.</P> <P>You could certainly set up a big ORed regex to sort data out in Splunk... but it is probably easier to split the data somehow before indexing via some other tool/script.</P> Fri, 23 Jan 2015 11:56:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-from-the-same-log-into-different-indexes/m-p/197487#M39234 Jason 2015-01-23T11:56:24Z