Splunk DB Connect: distribute events to different indexes

[FritzWittwer_ol]

We have data in a database from which we get records with db connect. They contain, among others, a selection field. The events must be filled into different indexes based on the selector field:

Event=1 Selector=a  => index_a
Event=2 Selector=b => index_b
Event=3 Selector=a => index_a

There might be hundreds of different values in the selector field and thus also hundreds of indexes. Using a own saved search or a search with a case statement is not really an option.

The events belong to different user groups and have to be distributed into different indexes to enforce access control. Using 'Restrict Search Terms' is not an option. I was thinking about something like

...| collect index=index_<<SelectorFieldValue>>

This works obviously not 😉 has anyone a hint?

[MuS]

Hi FritzWittwer,

If this is only related to new events, you can use this approach here https://answers.splunk.com/answers/354923/how-do-i-route-events-into-different-indexes-based.html which will rewrite the _MetaData:Index field based on the event content.

Existing, already index events need to be transferred using some export method or the collect command but this was marked as not an option.

Hope this helps ...

cheers, MuS