Newcomer to Splunk, just took the "Using Splunk" course and trying to learn how all of the pieces fit together.
I installed the Symantec DLP application, and set it up according to the documentation. It uses syslog to send events (incidents) into Splunk. I just got a couple of Events to show up in Splunk, so that's exciting!
However, it appears that the App is only looking for them in a "dlp" index. These events are coming into my "main" index. How do I map that all events logged via this host should go into a "dlp" index?
This is a great solution if you have a forwarder that you're using.
Unfortunately, I have an appliance that is sending syslog data on UDP 514 to the Indexer.
So, I'm looking for a solution that can be implemented on the Indexer only.
I guess I could create a custom index that listens on and accepts syslog from a unique port, then assign that port the index, but I was hoping for something a little more straightforward (as that solution also requires changing firewalls to open up additional ports).
I was hoping that I could just map the hostname to a specific index, as that hostname is never forwarding anything for a different index.
Answer: The only solution if you wish to send the data directly to the indexer is to do so on a custom port, so you can specific a unique index and sourcetype.
Solution: I moved the logs to the syslog aggregator, where I could monitor the path and provide a unique index and sourcetype, then that host is a universal forwarder to the index. Works great (but requires two systems).