Route specific events to a relative index

wayn23 — Tue, 29 Sep 2020 15:32:33 GMT

I need to retain events for different periods of time based on content. I have created indexes with different retentions, for example, audit_1YR, audit_2YR

I am using the advice in http://docs.splunk.com/Documentation/Splunk/6.6.3/Indexer/Setupmultipleindexes#Send_events_to_specific_indexes

I can successfully redirect to different absolute indexes using config like the following on the Indexer
$SPLUNK_HOME/etc/system/local/props.conf:
[my_sourcetype]
TRANSFORMS-index = Retain2Year

$SPLUNK_HOME/etc/system/local/transforms.conf:
[Retain2Year]
REGEX = (2YR)
DEST_KEY = _MetaData:Index
FORMAT = Audit_2YR

What I would like to be able to do is make the new index name be relative to the passed index name set in the Splunk Universal Forwarder, by just suffixing the index name. For example, something like
FORMAT = existingIndexName_2YR

Is that possible? How can the existing index name be referenced in the FORMAT statement? I have tried the following, which all failed
FORMAT = $index.$1
FORMAT = index::$index.$1
FORMAT = _meta:index.$1

Re: Route specific events to a relative index

wayn23 — Fri, 25 Aug 2017 21:59:17 GMT

I have this working now! The right reference was $0. The following statement is working for me
FORMAT=$0_2YR

I found the information at http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Data/Configureindex-timefieldextraction

Re: Route specific events to a relative index

DalJeanis — Fri, 25 Aug 2017 22:20:44 GMT

@wayn23 - We converted your comment to an answer, so you can mark the question as closed by accepting it. Happy splunking!

topic Re: Route specific events to a relative index in Splunk Search

Route specific events to a relative index

Re: Route specific events to a relative index

Re: Route specific events to a relative index