https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-in-a-syslog-file-to-separate-index/m-p/38460#M7091 <P>It would be ideal to send the syslog data straight to Splunk, and setup a separate port for the for the handful of hosts -- since you can specify an Index when defining the data input.</P> <P>Otherwise, you could use a RegEx to identify the data you want to move, like this:</P> <PRE><CODE>PROPS.CONF: [source::...mysyslogfile...] TRANSFORMS-movestuff = xf_index TRANSFORMS.CONF: [xf_index] REGEX = matchthis DEST_KEY = _MetaData:Index FORMAT = thisindex </CODE></PRE> <P>Use FORMAT to specify the index name. Don't forget to create your index, first.</P> Fri, 04 Feb 2011 05:03:05 GMT Ron_Naken 2011-02-04T05:03:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-in-a-syslog-file-to-separate-index/m-p/38459#M7090 <P>I have a simple syslog server that collects data from many hosts and splunk is indexing the syslog logfile. I would like to separate data from a handful of hosts into a separate index at index time. What would be the best way to go about this?</P> Fri, 04 Feb 2011 04:38:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-in-a-syslog-file-to-separate-index/m-p/38459#M7090 wczimmerman 2011-02-04T04:38:57Z https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-in-a-syslog-file-to-separate-index/m-p/38460#M7091 <P>It would be ideal to send the syslog data straight to Splunk, and setup a separate port for the for the handful of hosts -- since you can specify an Index when defining the data input.</P> <P>Otherwise, you could use a RegEx to identify the data you want to move, like this:</P> <PRE><CODE>PROPS.CONF: [source::...mysyslogfile...] TRANSFORMS-movestuff = xf_index TRANSFORMS.CONF: [xf_index] REGEX = matchthis DEST_KEY = _MetaData:Index FORMAT = thisindex </CODE></PRE> <P>Use FORMAT to specify the index name. Don't forget to create your index, first.</P> Fri, 04 Feb 2011 05:03:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-split-events-in-a-syslog-file-to-separate-index/m-p/38460#M7091 Ron_Naken 2011-02-04T05:03:05Z