All Apps and Add-ons

How do I redirect AWS events to different indexes by the content of the events in the AWS TA?

BlueSocket
Contributor

Hi,

I have a set of AWS inputs and I need to redirect events depending upon the names of the instances (which are in the events).
I have set up a transforms.conf to look like this:

[index_env1]
REGEX = env1
DEST_KEY = _MetaData:Index
FORMAT = env1

[index_env2]
REGEX = env2
DEST_KEY = _MetaData:Index
FORMAT = env2

In the inputs.conf, I have added a line:

TRANSFORMS-index_cloudwatch=index_env1,index_env2

When I restart Splunk, i get:

Invalid key in stanza [aws_cloudwatch://System CloudWatch_*******] in /opt/splunk/etc/apps/Splunk_TA_aws/local/inputs.conf, line 12: TRANSFORMS-index_cloudwatch (value: index_env1,index_env2)

I can't see what I am doing wrong, but is there any reason why I can't use this syntax to redirect the events to different indexes?
Is redirection of indexes not supported by AWS inputs? What else can I do?

0 Karma
1 Solution

p_gurav
Champion

You have to add this line in props.conf not in inputs.conf.

<sourcetype>
TRANSFORMS-index_cloudwatch=index_env1,index_env2

Transforms.conf seems ok.

View solution in original post

p_gurav
Champion

You have to add this line in props.conf not in inputs.conf.

<sourcetype>
TRANSFORMS-index_cloudwatch=index_env1,index_env2

Transforms.conf seems ok.

BlueSocket
Contributor

Ooooh. I feel a proper fool, now!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...