https://community.splunk.com/t5/Getting-Data-In/how-to-sett-forwarers-to-index-on-path-and-file-name/m-p/25752#M4218 <P>Thanks for that pointer, but I am not sure that is what I was really asking. The logs all go into one index but have the extra tags for cluster and host added by the forwarder.</P> <P>I could set up forwarders for each "log type". These should be able to add tags for the cluster and host and read all files of that log type under /home/info/data/logs/*/.</P> Thu, 12 Apr 2012 18:31:18 GMT jbirchall1 2012-04-12T18:31:18Z https://community.splunk.com/t5/Getting-Data-In/how-to-sett-forwarers-to-index-on-path-and-file-name/m-p/25750#M4216 <P>Is it possible to set up forwarders to index data on the path of the file and a portion of the file name automatically. </P> <P>Ie </P> <P>/home/info/data/logs/"cluster"/host1.type1.log<BR /> /home/info/data/logs/"cluster"/host2.type2.log</P> <P>The setup should automatically forward any files under /home/info/data/logs and add indexes for the "cluster" and the host? Any pointers in the right direction would be helpfull</P> Thu, 12 Apr 2012 17:07:13 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-sett-forwarers-to-index-on-path-and-file-name/m-p/25750#M4216 jbirchall1 2012-04-12T17:07:13Z https://community.splunk.com/t5/Getting-Data-In/how-to-sett-forwarers-to-index-on-path-and-file-name/m-p/25751#M4217 <P>You'd need to set up props/transforms where the data is being parsed(heavy forwarder/Indexer) to route data to specific indexes based on a regex:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/Setupmultipleindexes#Route_specific_events_to_a_different_index">http://docs.splunk.com/Documentation/Splunk/latest/admin/Setupmultipleindexes#Route_specific_events_to_a_different_index</A></P> Thu, 12 Apr 2012 18:08:56 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-sett-forwarers-to-index-on-path-and-file-name/m-p/25751#M4217 jbsplunk 2012-04-12T18:08:56Z https://community.splunk.com/t5/Getting-Data-In/how-to-sett-forwarers-to-index-on-path-and-file-name/m-p/25752#M4218 <P>Thanks for that pointer, but I am not sure that is what I was really asking. The logs all go into one index but have the extra tags for cluster and host added by the forwarder.</P> <P>I could set up forwarders for each "log type". These should be able to add tags for the cluster and host and read all files of that log type under /home/info/data/logs/*/.</P> Thu, 12 Apr 2012 18:31:18 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-sett-forwarers-to-index-on-path-and-file-name/m-p/25752#M4218 jbirchall1 2012-04-12T18:31:18Z