topic Re: How and where do I configure props and transforms to forward a few events into a particular index by host? in Getting Data In

How and where do I configure props and transforms to forward a few events into a particular index by host?

allan_newton — Tue, 15 Sep 2015 03:53:27 GMT

Hi,

I have 4 forwarders, 4 search heads, and 2 forwarders in my Splunk cluster. Now one of the forwarders is configured to read data from UDP port 514. The data comes in to the forwarder and it then is forwarded to the indexers.

Now I need to apply configurations in transforms.conf and props.conf to write few events into a separate index by host. Where do I put those configurations? Should I do the changes in the forwarder or the indexer?

Thanks.

Re: How and where do I configure props and transforms to forward a few events into a particular index by host?

MuS — Tue, 15 Sep 2015 03:59:19 GMT

Hi allan_newton,

try something like this,un-tested and out of my head:

props.conf

[source::udp:514]
TRANSFORMS-001_changemetadata = redirect_to_index_foo

transforms.conf

[redirect_to_index_foo]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(10.10.10.d+)$
FORMAT = foo
DEST_KEY = _MetaData:Index

Don't forget to restart the forwarder after you changed the props and transforms.
Hope this helps ...

cheers, MuS

Re: How and where do I configure props and transforms to forward a few events into a particular index by host?

allan_newton — Tue, 15 Sep 2015 04:04:17 GMT

Instead of ^host::(10.10.10.d+)$ can i use host::(10.10.10.32) ?