topic Re: Forward messages to different indexes based on the value of its field in Getting Data In

Forward messages to different indexes based on the value of its field

myordanov95 — Wed, 25 Jul 2018 10:43:34 GMT

Is it possible to forward messages to different indexes based on the value of message field ?
And which forwarder is the most appropriate (Universal or Heavy) ?

Re: Forward messages to different indexes based on the value of its field

sudosplunk — Wed, 25 Jul 2018 13:44:32 GMT

Yes. Using props.conf and transforms.conf, you can achieve this. Please provide some sample data to perform regex matching. Otherwise, below is the basic structure of configuration settings for routing events.

Props.conf:

[your_custom_sourcetype]
TRANSFORMS-routing = routing_based_on_field_values

Transforms.conf:

[routing_based_on_field_values]
REGEX = <your_custom_regex>
DEST_KEY = _MetaData:Index
FORMAT = <alternate_index_name>

You can find more information in below links, let me know if this helps.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Setupmultipleindexes#Route_specific_events_to_a_different_index

https://answers.splunk.com/answers/566448/route-specific-events-to-a-relative-index.html

Re: Forward messages to different indexes based on the value of its field

myordanov95 — Wed, 25 Jul 2018 14:07:23 GMT

In case of having a thousands of different values , I want to create thousands of indexes. Does it mean I have to declared thousands of stanzas.

Re: Forward messages to different indexes based on the value of its field

sudosplunk — Wed, 25 Jul 2018 14:14:17 GMT

Oh, you want to route each event with different value to a different index? I thought, you want to look for specific value in the raw events and route all the events which have this specific value to different index(s).

Re: Forward messages to different indexes based on the value of its field

myordanov95 — Wed, 25 Jul 2018 14:23:27 GMT

Yes, I want to forward events with different value to a different indexes.

Re: Forward messages to different indexes based on the value of its field

sudosplunk — Wed, 25 Jul 2018 14:34:10 GMT

Can you provide some sample events with values which you want to route.

Re: Forward messages to different indexes based on the value of its field

myordanov95 — Wed, 25 Jul 2018 14:37:38 GMT

{"name":"value1"},
{"name":"value2"},
....
{"name":"value1000"}

In this case, I want to forward events to 1000 indexes.

Re: Forward messages to different indexes based on the value of its field

sudosplunk — Wed, 25 Jul 2018 14:46:08 GMT

Are all these events coming from 1 source/host? Also, why do you want to forward each event to each index.

Re: Forward messages to different indexes based on the value of its field

myordanov95 — Wed, 25 Jul 2018 14:54:06 GMT

Sorry, I am looking for solution of this problem.