Selective forwarding and overrride destination sourcertype and index

adityapavan18 — Sun, 05 Aug 2012 07:49:10 GMT

I have a setup where syslog feed is received by a heavy forwarder on udp port. Syslog feed on that particular udp port has sourcetype=syslog_feed and index=syslog_index . And from there i have to route the syslog feed to Actual Indexers.

Now what configuration changes i have to make to forward the data with sourcetype=sl_feed and destination index=sl_index .

Re: Selective forwarding and overrride destination sourcertype and index

kristian_kolb — Mon, 28 Sep 2020 12:15:06 GMT

Hi there,

If you use a Heavy forwarder, you should set the correct sourcetype and index there straight away, since a Heavy forwarder will perform the input and parsing phases. Therefore you should edit the inputs.conf on the Heavy forwarder to the values you want, i.e. sl_feed and sl_index.

For more information on what configuration goes where, see http://docs.splunk.com/Documentation/Splunk/4.3.3/Admin/Configurationparametersandthedatapipeline or
http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

Hope this helps,

Kristian

topic Selective forwarding and overrride destination sourcertype and index in Getting Data In

Selective forwarding and overrride destination sourcertype and index

Re: Selective forwarding and overrride destination sourcertype and index