topic Re: Same log different indexers and index in Getting Data In

Solved: Same log different indexers and index

biagiodipalma — Wed, 14 Apr 2021 10:25:15 GMT

hi there,

I have some machines that collect Security logs from Windows. The universal forwarder on machines have this kind of conf:

[WinEventLog://Security] index=a _TCP_ROUTING=indexer1, indexer2

Indexer1 and indexer2 are part of two different Splunk Enterprise installations: for indexer1 the 'a' index is correct, but the indexer2 puts security logs on index 'b'.

So I need to change my index on indexers or on heavy forwarders. How can I do this?

##########
I've tried this on indexer:
props.conf

[source::WinEventLog:Security] TRANSFORMS-indexing1 = idx_change

transforms.conf

[idx_change] SOURCE_KEY=_raw REGEX=. DEST_KEY=_Metadata:Index FORMAT=b

Re: Same log different indexers and index

aasabatini — Tue, 13 Apr 2021 17:47:19 GMT

Hi @biagiodipalma

Can you share the outputs.conf configuration?

I need that configuration to understand the forwarder routing

Re: Same log different indexers and index

biagiodipalma — Tue, 13 Apr 2021 20:47:46 GMT

On tre Forwarder the outputs.conf is like this:

[tcpout:groupA]
server=indexer1:9997

[tcpout:groupB]
server=indexer2a:9997, indexer2b:9997

above I mentioned groupA as indexer1 and groupB as indexer2: groupB is made of two indexers in cluster

Re: Same log different indexers and index

biagiodipalma — Wed, 14 Apr 2021 10:24:25 GMT

SOLVED: in inputs.conf just specify the sourcetype or the source in order to let indexer intercept data and apply the transforms' stanza.

So my inputs.conf is like this:

[WinEventLog://Security] index=a sourcetype=WinEventLog source=WinEventLog:Security _TCP_ROUTING=group a, group b