All Apps and Add-ons

Route Traffic to Index via Transforms.conf and Props.conf


Here is our situation:
Universal forwarders(UF) on hosts (50-ish) are sending data to a heavy forwarder(HF) configured to store AND forward which is sending data to our Indexer. Our data is currently coming into the "main" index, however we would like it to go into a different index we'll call it "norris".

For simplicity let's just say we cannot modify the Universal Forwarders Inputs.conf.

I modified the props.conf and tranforms.conf on my indexer and had zero luck. Here is what I modified:

TRANSFORMS-routing_for_norris_index = route_to_norris_index

#Route to an alternate Index:
DEST_KEY = _MetaData:Index
FORMAT = norris

Do I need to add this to the HF transforms and props as well?

0 Karma

Path Finder

try this in transforms.conf

KEY = _MetaData:Index

note that there is space between REGEX and equal sign

REGEX = (.*)
FORMAT = norris

Also make sure that the host field value is correct

0 Karma


I tired and unfortunately it did not work.

Do the transforms and props config files need to be modified at the indexer or the Heavy Forwarder?

0 Karma