https://community.splunk.com/t5/Getting-Data-In/How-do-I-route-data-based-on-the-Index-field/m-p/271023#M52020 <P>Assuming I have a forwarder with inputs.conf:</P> <PRE><CODE>[monitor:///var/log/notcritical] index=datacritical [monitor:///var/log/critical] index=datanoncritical </CODE></PRE> <P>How can I route the events from the two files into two different Splunk Indexers based purely on the value of Indexer field?</P> Mon, 12 Dec 2016 10:57:43 GMT mzorzi 2016-12-12T10:57:43Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-route-data-based-on-the-Index-field/m-p/271023#M52020 <P>Assuming I have a forwarder with inputs.conf:</P> <PRE><CODE>[monitor:///var/log/notcritical] index=datacritical [monitor:///var/log/critical] index=datanoncritical </CODE></PRE> <P>How can I route the events from the two files into two different Splunk Indexers based purely on the value of Indexer field?</P> Mon, 12 Dec 2016 10:57:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-route-data-based-on-the-Index-field/m-p/271023#M52020 mzorzi 2016-12-12T10:57:43Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-route-data-based-on-the-Index-field/m-p/271024#M52021 <P>You should be able to forward based on value in the index field with this transforms.conf.</P> <P>[send_to_critical]<BR /> SOURCE_KEY = _MetaData:Index<BR /> REGEX = datacritical<BR /> DEST_KEY = _TCP_ROUTING<BR /> FORMAT = critical</P> <P>[send_to_noncritical]<BR /> SOURCE_KEY = _MetaData:Index<BR /> REGEX = datanoncritical<BR /> DEST_KEY = _TCP_ROUTING<BR /> FORMAT = noncritical</P> <P>You the need to create a props.conf and make sure these two rules are applied to each event. You will then also need an outputs.conf with the two different tcpout groups, critical and noncritical.</P> Tue, 29 Sep 2020 12:03:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-route-data-based-on-the-Index-field/m-p/271024#M52021 mzorzi 2020-09-29T12:03:52Z