topic How to change the target index for logs from certain servers with a Windows universal forwarder, but keep the correct sourcetype? in Getting Data In

How to change the target index for logs from certain servers with a Windows universal forwarder, but keep the correct sourcetype?

feisar — Fri, 18 Sep 2015 11:25:57 GMT

Hi,

I have one Splunk Enterprise server and a number of Windows servers with the Universal forwarder installed and configured to send logs to the server (indexer).

The logs all arrive and get tagged with the index 'wineventlog' and an appropriate sourcetype, 'WinEventLog:Security' or 'WinEventLog:System' etc. - All good stuff.

However, I'd like to change the index for certain servers (as I have done for various switches etc.). I have tried this using props.conf and transforms.conf with rules like this:

props.conf

[host::WINSERVER01]
TRANSFORMS-winevent_dmz = set_index_winevent_dmz

transforms.conf

[set_index_winevent_dmz]
DEST_KEY = _MetaData:Index
FORMAT = winevent_dmz
REGEX = .

But when I do this, although the index does change, the appropriate sourcetype stops being applied and the logs all get assigned a 'splunkd' sourcetype.

Can anyone explain why this happens and let me know the correct way to change the index of logs coming from the Forwarder, but keep the correct sourcetype?

Thanks

Re: How to change the target index for logs from certain servers with a Windows universal forwarder, but keep the correct sourcetype?

woodcock — Fri, 18 Sep 2015 13:35:04 GMT

I don't know why it is happening but you can add a sourcetype= directive to your props.conf stanza to force it back.

Re: How to change the target index for logs from certain servers with a Windows universal forwarder, but keep the correct sourcetype?

maciep — Tue, 29 Sep 2020 07:18:35 GMT

Look like you are applying that change to all data coming from that host. That includes splunk's internal log files. Are you sure that you're not just accidentally sending the _internal data to the winevent_dmz index now? Maybe along with the eventlog data? That would explain the splunkd sourcetype.

Also, it might be easier to just do this from the frowarder on winserver01 in the inputs.conf. Just update the index there. If you have windows app installed, just be sure to make your changes in the local directory instead of default.

Re: How to change the target index for logs from certain servers with a Windows universal forwarder, but keep the correct sourcetype?

sanjeev543 — Wed, 11 Sep 2019 07:31:12 GMT

I agree with @maciep , if you still want to move to other index at the index time, please check if you can do it by using sourcetype
For example:

props.conf

[WinEventLog:Security]
TRANSFORMS-winevent_dmz = set_index_winevent_dmz

transforms.conf

[set_index_winevent_dmz]
SOURCE_KEY = MetaData:Host
REGEX = (WINSERVER01|WINSERVER02|WINSERVER03....)
DEST_KEY = _Metadata:Index
FORMAT = winevent_dmz