topic Re: How to specify an index for storing data from forwarders in Getting Data In

How to specify an index for storing data from forwarders

nickcode — Mon, 20 May 2013 08:21:01 GMT

How to specify different indexes for storing data of different source(sourcetype)? The data is coming from remote forwarders.

Re: How to specify an index for storing data from forwarders

martin_mueller — Mon, 20 May 2013 08:24:03 GMT

By specifying a different index inside each monitor stanza in inputs.conf, see http://docs.splunk.com/Documentation/Splunk/latest/Data/Editinputs.conf#Configuration_settings and http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf for reference.

Re: How to specify an index for storing data from forwarders

Ayn — Mon, 20 May 2013 08:30:42 GMT

...on the remote forwarders that is.

If you can't affect how things are setup on these forwarders, you can also rewrite which index events are stored in by using transforms on the indexer. But really, the best thing is to get it right from the start on the forwarders instead.

Re: How to specify an index for storing data from forwarders

nickcode — Mon, 20 May 2013 08:49:44 GMT

martin_mueller's solution may not be suitable for my requirement. Then, how to use transforms on the indexer or config the forwarders, Ayn?

Re: How to specify an index for storing data from forwarders

Ayn — Mon, 20 May 2013 09:01:12 GMT

Define an index-time transform on the indexer and have it apply to the appropriate events.

For example:

props.conf:

[myfavoritesourcetype]
TRANSFORMS-index=sendtomyindex

transforms.conf:

[sendtomyindex]
REGEX=.
DEST_KEY=_MetaData:Index
FORMAT=myindex
WRITE_META=true

Re: How to specify an index for storing data from forwarders

nickcode — Mon, 20 May 2013 09:21:44 GMT

Thank you, I'll try it. By the way, how to get it right from the start on the forwarders as you refered above.

Re: How to specify an index for storing data from forwarders

Ayn — Mon, 20 May 2013 10:17:17 GMT

See martin's answer for more info on that.