topic route data to custom index using source in Getting Data In

route data to custom index using source

saifuddin9122 — Tue, 29 Sep 2020 11:27:38 GMT

i have three different source
1. /var/log/auth.log
2. /var/log/syslog

i want data to route my custom index

source 1 and source 2 to INDEXA

can any one help me??

i tried this, but it didn't worked

props.conf

[/var/log/auth.log]
TRANSFORMS-routing_for_var_log_auth_source = route_to_indexa

[/var/log/syslog]
TRANSFORMS-routing_for_var_log_syslog_source =route_to_indexb

transforms.conf

[route_to_indexa]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = indexa

[route_to_indexb]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = indexa

Re: route data to custom index using source

lukejadamec — Tue, 18 Oct 2016 16:16:52 GMT

Destination indexes are typically specified in the inputs.conf
Can you post your inputs.conf entries for these sources?

Re: route data to custom index using source

saifuddin9122 — Tue, 18 Oct 2016 16:23:02 GMT

As these sources are from network components, we don't have any control on inputs,

logging is enabled using the GUI of that particular Network component where we need to provide splunk Indexer Ip and port.

Re: route data to custom index using source

lukejadamec — Tue, 18 Oct 2016 16:36:09 GMT

Regardless of whether you use the GUI or not, there is an inputs.conf file for these inputs (the GUI creates it).
If they are coming from different IPs or the same IP and different ports, then the index= parameter can be added to those inputs.conf stanzas.
If all sources are coming in on the same IP and port, then doing this in props/transforms is the way to go.

Re: route data to custom index using source

saifuddin9122 — Tue, 18 Oct 2016 18:05:46 GMT

its is not splunk GUI,
it is GUI of that network component.

Re: route data to custom index using source

lukejadamec — Tue, 18 Oct 2016 18:11:07 GMT

I did not know that Splunk could index data without an inputs.conf stanza for that data. I guess I'll have to study more. What is the network component manufacturer/model?

Re: route data to custom index using source

somesoni2 — Tue, 18 Oct 2016 18:31:45 GMT

The props.conf stanza name for source (and host) should start with source:: (or host:: for host), like this.
props.conf

[source::/var/log/auth.log]
TRANSFORMS-routing_for_var_log_auth_source = route_to_indexa

[source::/var/log/syslog]
TRANSFORMS-routing_for_var_log_syslog_source =route_to_indexb