https://community.splunk.com/t5/Getting-Data-In/How-to-segment-syslog-events-by-indexer/m-p/327554#M60816 <P>Have a look at this:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Filter_and_route_event_data_to_target_groups">http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Filter_and_route_event_data_to_target_groups</A></P> <P>This links gives you a sample configuration for routing event to different indexer (as defined in tcpout group in outputs.conf) based on keywords in the event's raw data. </P> <P>Please note this needs to be setup on the first Splunk Enterprise instance in your data flow (if using Heavy Fwd, setup on those Or to be set on indexers).</P> Wed, 11 Apr 2018 21:00:44 GMT somesoni2 2018-04-11T21:00:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-segment-syslog-events-by-indexer/m-p/327553#M60815 <P>Hi everyone, </P> <P>I am trying to configure one way to segment syslog events by user.</P> <P>Example:<BR /> Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP01|...<BR /> Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP02|...<BR /> Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP03|...</P> <P>I would like to send all syslog with: <BR /> SERVERGROUPNAME=SRVGP01 to indexer X<BR /> SERVERGROUPNAME=SRVGP02 to indexer Y<BR /> SERVERGROUPNAME=SRVGP03 to indexer Z</P> <P>How can I do that?</P> <P>Thanks!<BR /> Vitor Pedralli</P> Wed, 11 Apr 2018 16:35:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-segment-syslog-events-by-indexer/m-p/327553#M60815 vitorpedralli 2018-04-11T16:35:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-segment-syslog-events-by-indexer/m-p/327554#M60816 <P>Have a look at this:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Filter_and_route_event_data_to_target_groups">http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Filter_and_route_event_data_to_target_groups</A></P> <P>This links gives you a sample configuration for routing event to different indexer (as defined in tcpout group in outputs.conf) based on keywords in the event's raw data. </P> <P>Please note this needs to be setup on the first Splunk Enterprise instance in your data flow (if using Heavy Fwd, setup on those Or to be set on indexers).</P> Wed, 11 Apr 2018 21:00:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-segment-syslog-events-by-indexer/m-p/327554#M60816 somesoni2 2018-04-11T21:00:44Z