topic How do I edit my configuration to assign Websense data to different indexes instead of going to the main index? in Getting Data In

How do I edit my configuration to assign Websense data to different indexes instead of going to the main index?

janderson19 — Wed, 08 Jun 2016 17:32:50 GMT

Hello,

I've been trying to get Websense data to go into two different indexes based on whether or not the action was blocked. The reason I am doing this is because Websense is generating ~7GB of data every day, which is too much for the HDDs on the indexer to handle.

I've set up all my .confs in $SPLUNK_HOME/etc/apps/search/local. Here are the relevant lines:

Inputs.conf

[udp://514] 
connection_host = ip 
host = xx.xx.x.xxx 
sourcetype = websense_summary

props.conf

[host::xx.xx.x.xxx]
NO_BINARY_CHECK = true
TRANSFORMS-websense = setBlockedIndex, setPermittedIndex

transforms.conf

[setBlockedIndex]
DEST_KEY = MetaData:Index
REGEX = action\s*=\s*blocked
FORMAT = index::WebsenseBlocked

[setPermittedIndex]
DEST_KEY = MetaData:Index
REGEX = .
FORMAT = index::WebsensePermitted

When I look for the data, it shows up in index=main, instead of the assigned indexes.

Re: How do I edit my configuration to assign Websense data to different indexes instead of going to the main index?

shaskell_splunk — Wed, 08 Jun 2016 20:37:30 GMT

I believe you just have a typo in your DEST_KEY and you can strip 'index:' off the FORMAT portion.

DEST_KEY = _MetaData:Index
FORMAT = myindex

See this section from transforms.conf.spec



_MetaData:Index     : The index where the event should be stored.

Re: How do I edit my configuration to assign Websense data to different indexes instead of going to the main index?

Masa — Wed, 08 Jun 2016 22:27:45 GMT

I agree.
Please keep in mind that host stanza in props.conf cannot be defined by host field in inputs.conf. If you're looking for a certain source ip address who is sending udp packets, you need to specify the source IP.