I have a |mcollect job that runs every night. I'd like the the results to goto a different indexer rather than the default on my search heads.
How do I specify the metric sourcetype in a props+transform to redirect it?
you need to add a sourcetype to the mcollect that does exists anywhere else, and use this in your props.conf & transforms.conf to redirect the collected events.
The following is UNTESTED and might as well not work - but should give you an idea how it can be approached.
First configure props.conf on the parsing layer that receives the events from your search head (eq HWF or IDX):
TRANSFORMS-001-SendMyMcollectSourceTypeToAnotherIndexer = SendMyMcollectSourceTypeToAnotherIndexer
next you need a transforms.conf to tell Splunk what to do with the events:
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = MyMcollectSourceTypeToAnotherIndexer
last but not least you need to configure an outputs.conf to tell Splunk where to send the events:
server = TheOtherServerDNSName:9997
Restart this Splunk instance, and run on your search head the mcollect search:
... | mcollect index=<string> sourcetype=MyMcollectSourceType
This should in theory work, but as mentioned previously this is untested so might as well not work ¯\_(ツ)_/¯
Anyway, hope this helps to get you started ...
and add to the outputs.conf the following stanza/option:
indexAndForward = true