topic Re: copy sourcetype and regex from one index to other index in Splunk Search

copy sourcetype and regex from one index to other index

felipesewaybric — Thu, 05 Dec 2013 16:05:02 GMT

how i can copy sourcetype and regex from one index to other index?

Re: copy sourcetype and regex from one index to other index

alacercogitatus — Thu, 05 Dec 2013 16:19:42 GMT

You don't. sourcetype is set at the Inputs level. Regex is set for Search time. It doesn't matter which index the data is residing in, as long as the sourcetypes are the same.

You will want to review this: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Prerequisitesforknowledgemanagement

Re: copy sourcetype and regex from one index to other index

somesoni2 — Thu, 05 Dec 2013 17:22:50 GMT

Regex (field extraction) as coupled with sourcetype itself, so you don't need anything to be done there. Sourcetype and index are not directly related and their relationship is defined via inputs. While configuring inputs, you specify data from the input should go to which index and follow properties of which sourcetype. So if you want data for one sourcetype to be stored in indexB instead on indexA, you need to change your input to index data in indexB-sourcetype instead of (current) indexA-sourcetype.