https://community.splunk.com/t5/Getting-Data-In/How-to-route-data-from-forwarders-to-separate-indexes-based-on/m-p/212674#M41817 <P><STRONG>Short answer</STRONG><BR /> Universal Forwards can't inspect data. Heavy Forwarders (and Indexers) can.</P> <P><STRONG>Long answer</STRONG><BR /> Use regex to parse the values of your JSON events and then redirect (override) accordingly to the right index.<BR /> See this:</P> <P><A href="https://answers.splunk.com/answers/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-naming-convention.html">https://answers.splunk.com/answers/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-naming-convention.html</A><BR /> <A href="https://answers.splunk.com/answers/246672/how-can-i-override-an-index-name-based-on-sourcety.html">https://answers.splunk.com/answers/246672/how-can-i-override-an-index-name-based-on-sourcety.html</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides">http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides</A></P> Fri, 19 Feb 2016 14:03:41 GMT javiergn 2016-02-19T14:03:41Z https://community.splunk.com/t5/Getting-Data-In/How-to-route-data-from-forwarders-to-separate-indexes-based-on/m-p/212673#M41816 <P>I have log data from multiple sources coming into a single TCP port in JSON format as below:</P> <PRE><CODE>&lt;01&gt;- hostname {"name":"DefaultProfile","version":"1.0","isonjkpFormat":"yyyy-MM-dd'T'HH:mm:ss.SSSZ","type":"Event","category":"RT_FLOW_SESSION_CREATE_LS" [helps@2222.2.2.2.2.22 localis-compute-zxcv=\"ABC1\" application=\"UNKNOWN\" MKUNJI-application=\"UNKNOWN\" mnbhyujgt=\"UNKNOWN\"]","bgasbnJuh":"1","mnbIPOUN":"other","absIPPOL":"other","qweTgvfrt":"minj-bag6-7856ab-Hnqasui","abcPecpokk":"och-00-145-987.Net_11_4_5_6","mnbJhbpoiu":"other","source":"My application1","nhjRkyhcfBhytf":"MKI-PLO-ASW","thuHyrtfcQhbnjuytfv":"192.168.1.11"} </CODE></PRE> <P>From this input, I want to forward the data to separate indexes based on the values for the source field.</P> <P>Example: if source: application1, then send to index1, and so on.<BR /> Does the Splunk forwarder have this capability to extract a field and segregate the events to separate indexes on the indexer?</P> Fri, 19 Feb 2016 10:00:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-route-data-from-forwarders-to-separate-indexes-based-on/m-p/212673#M41816 bkumarm 2016-02-19T10:00:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-route-data-from-forwarders-to-separate-indexes-based-on/m-p/212674#M41817 <P><STRONG>Short answer</STRONG><BR /> Universal Forwards can't inspect data. Heavy Forwarders (and Indexers) can.</P> <P><STRONG>Long answer</STRONG><BR /> Use regex to parse the values of your JSON events and then redirect (override) accordingly to the right index.<BR /> See this:</P> <P><A href="https://answers.splunk.com/answers/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-naming-convention.html">https://answers.splunk.com/answers/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-naming-convention.html</A><BR /> <A href="https://answers.splunk.com/answers/246672/how-can-i-override-an-index-name-based-on-sourcety.html">https://answers.splunk.com/answers/246672/how-can-i-override-an-index-name-based-on-sourcety.html</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides">http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides</A></P> Fri, 19 Feb 2016 14:03:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-route-data-from-forwarders-to-separate-indexes-based-on/m-p/212674#M41817 javiergn 2016-02-19T14:03:41Z