https://community.splunk.com/t5/Getting-Data-In/Direct-to-an-index-based-on-raw/m-p/240565#M46753 <P>Restarted Splunk and problem went away. Not sure what was up there, but it's working now. </P> Sat, 26 Sep 2015 10:28:50 GMT daniel333 2015-09-26T10:28:50Z https://community.splunk.com/t5/Getting-Data-In/Direct-to-an-index-based-on-raw/m-p/240564#M46752 <P>All, </P> <P>I am looking to route data to an index based on contents of the _raw. </P> <P>Basically I have app that runs every so often and logs to /var/log/message on a Linux system. If i see "arpwatch" in the text I want the event to end up in index=arpwatch. </P> <P>Assuming I don't want to mess with the logging facilities at this time to create another log file. Is this something Splunk can do? </P> <P>Here is what I have so far on my all in one box. It sorta works, but I am getting the hostname AND index overwritten to be arpwatch rather than just the index. </P> <P><STRONG>props.conf</STRONG><BR /> [syslog]<BR /> BREAK_ONLY_BEFORE = ^<BR /> TRANSFORMS-indexrouting = arpwatch</P> <P><STRONG>transforms.conf</STRONG><BR /> [arpwatch]<BR /> REGEX = (?i) .<EM>app=arpwatch.</EM><BR /> DEST_KEY = _MetaData:Index<BR /> FORMAT = arpwatch</P> Tue, 29 Sep 2020 07:22:41 GMT https://community.splunk.com/t5/Getting-Data-In/Direct-to-an-index-based-on-raw/m-p/240564#M46752 daniel333 2020-09-29T07:22:41Z https://community.splunk.com/t5/Getting-Data-In/Direct-to-an-index-based-on-raw/m-p/240565#M46753 <P>Restarted Splunk and problem went away. Not sure what was up there, but it's working now. </P> Sat, 26 Sep 2015 10:28:50 GMT https://community.splunk.com/t5/Getting-Data-In/Direct-to-an-index-based-on-raw/m-p/240565#M46753 daniel333 2015-09-26T10:28:50Z