topic Re: Move input to different index in Splunk Search

Move input to different index

rblalock — Wed, 15 Aug 2012 15:57:40 GMT

I have too many machines (almost 500) logging to a single index. I want to create a new index (which I know how to do) and configure some host inputs to write to the new index instead of the old one. All sources are syslog type on UDP 514.

Re: Move input to different index

johandk — Wed, 15 Aug 2012 16:56:42 GMT

As per the docs:

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data.27s_input

On the Universal or Heavy forwarder in inputs.conf (depending on the type of input):

[monitor://.../file1.log]
_TCP_ROUTING = group1

And then in outputs.conf:

[tcpout:group1]
server=server1:9997

Should work.. Untested. Examples stolen from docs. Let us know if this works...

EDIT

I have no idea whether the UDP input to TCP routing will work... Really curious to see how this pans out.

Re: Move input to different index

rblalock — Wed, 15 Aug 2012 17:18:44 GMT

OK, so I was expecting this to be a server-side solution. This looks like a client-side solution. Do I have that right?

Re: Move input to different index

johandk — Wed, 15 Aug 2012 17:26:31 GMT

Well... yes. Using a Heavy forwarder you can make it server side. Otherwise use the deployment server which manages all your forwarder configs centrally.