topic Re: Field extraction and conditional splitting into different indexes on a heavy forwarder in Splunk Search

Field extraction and conditional splitting into different indexes on a heavy forwarder

wirelessy — Tue, 29 Sep 2020 10:07:15 GMT

Hello,

In my environment I have a setup of two heavy forwarders forwarding to a set of clustered indexers.
I want those forwarders to receive syslog, and depending on the facility/severity the incoming data should be forwarded to different indexes.

To get the syslog facility/severity, I want to do a lookup for the priority I receive in the event. To do that lookup, I figured I need a named field for the priority.
So I created an app for those forwarders with the following:

props.conf:

[generic_syslog]
EXTRACT-extract_syslog_priority = ^<(?<syslog_priority>\d+)> 
LOOKUP-lookup_syslog_priority = syslog_priority_lookup syslog_priority OUTPUTNEW syslog_facility, syslog_severity

transforms.conf

[syslog_priority_lookup]
filename = syslog_priorities.csv

However, above config does not seem to work. The indexed events have no fields as "syslog_priority", nor "syslog_facility" or the severity.

What am I getting wrong here?

Re: Field extraction and conditional splitting into different indexes on a heavy forwarder

dwaddle — Wed, 29 Jun 2016 17:10:14 GMT

Sorry, won't work 😞

Lookups and field extractions using EXTRACT are a search time function, and cannot be made to "fire" during index time pipeline processing. You'll need to come up with another way of accomplishing index-time routing - probably based on regex alone.

Re: Field extraction and conditional splitting into different indexes on a heavy forwarder

wirelessy — Thu, 30 Jun 2016 13:53:09 GMT

Well, that does indeed explain what I am getting wrong :). Thank you!
I took that idea off of this app: https://splunkbase.splunk.com/app/736/
Am I correct on the assumption this would work again, if it wasn't for my 6.4.1 heavy forwarder, but 6.3 or older?

Sadly, I am left alone in the field with (so far) zero experience in configuring Splunk.
I don't think I fully understand what possibilities I have to achieve that, and where/how to configure those. Could you provide me with a possible way, or just a keyword that I can go dig into?

Maybe a similar example, on which I can go full copycat again?