topic Re: How to specifiy incoming source type to a specific index? in Splunk Search

How to specifiy incoming source type to a specific index?

gingerpower121 — Tue, 29 Sep 2020 13:41:50 GMT

I understand you have to modify the indexes.conf, props.conf, and transforms.conf inside of the $SPLUNK/etc/system/local directory but I am completely lost what to fill in. I have the documentation for each file pulled up but I'm still not getting very far.

The only file I've really changed is the indexes.conf:

[cisco_asa]
sourcetype = cisco:asa
disabled = 0
index = cisco_asa
frozenTimePeriodInSecs = 15800000

EDIT:
I'm trying to separate my ASA to it's own index for different retention policies and a smaller database. The ASA already comes across splunk as "cisco:asa" so I'm mostly trying to match that source type to a index. Although in the future I'd like to start specifying by IP address to an index.

I've made some changes and this is what I have but still no luck:

indexes.conf:
[cisco_asa]
disabled = 0
frozenTimePeriodInSecs = 15800000

props.conf:
[cisco:asa]
TRNASFORMS-8_AssignToIndex = cisco:asa

transforms.conf:
[cisco:asa]
REGEX = .
DEST_KEY = _Metadata:Index
FORMAT = cisco:asa

Re: How to specifiy incoming source type to a specific index?

richgalloway — Tue, 18 Apr 2017 14:15:18 GMT

The most common settings for the indexes.conf file can be set in the GUI by selecting Settings->Indexes. In your example, the sourcetype and index attributes are not valid in indexes.conf. The index name is set by the stanza name and sourcetype goes in props.conf. You use index in inputs.conf.

Be careful to not confuse the documentation for each config file. Attributes for one file do not necessarily apply to others.

I think you're close with your transforms attributes. Try FORMAT = cisco_asa.

Re: How to specifiy incoming source type to a specific index?

gingerpower121 — Tue, 18 Apr 2017 14:57:46 GMT

My goal is to move my ASA to a different index for a smaller retention policy and less storage. The ASA sourcetype already shows up as being "cisco:asa" so I'm mostly trying to match that source type to an index. Although in the future I would like to setup indexes by IP address.

I've made a few changes to my config:

index.conf:
[cisco_asa]
disabled = 0
frozenTimePeriodInSecs = 15800000

props.config:
[cisco:asa]
TRNASFORMS-8_AssignToIndex = cisco:asa

transforms.conf:
[cisco:asa]
REGEX = .
DEST_KEY = _Metadata:Index
FORMAT = cisco:asa

Still no luck but any idea what I'm missing?

Re: How to specifiy incoming source type to a specific index?

richgalloway — Tue, 18 Apr 2017 20:22:04 GMT

Please see my updated answer.

Re: How to specifiy incoming source type to a specific index?

gingerpower121 — Tue, 18 Apr 2017 20:50:38 GMT

Changed last line to cisco_asa but still didn't switch.