Archive

Reroute data that is marked for an index?

the_wolverine
Champion

I have syslog-ng data coming from LWFs that have been earmarked for indexA. I want to intercept these events and reroute them to another index called indexB. It doesn't seem to be working. Am I missing something basic?

The sourcetype is syslog so in props I have:

[syslog]
TRANSFORMS-route = route2indexB

transforms.conf:

[route2indexB]
REGEX=(192.168.1.12)
DEST_KEY = _MetaData:Index
FORMAT = indexB

I've tried multiple iterations of this configuration including using source and host in props.conf. I can't seem to get the data to go to indexB.

0 Karma
1 Solution

the_wolverine
Champion

Turns out the LWF was not a LWF. It was a heavyweight forwarder 🙂

Thanks to Raitz for figuring that out. He spotted the _linebreaker in the tcpdump output which is an indication of cooked data.

I had the system owner enable LWF from CLI and all is working as expected.

View solution in original post

the_wolverine
Champion

Turns out the LWF was not a LWF. It was a heavyweight forwarder 🙂

Thanks to Raitz for figuring that out. He spotted the _linebreaker in the tcpdump output which is an indication of cooked data.

I had the system owner enable LWF from CLI and all is working as expected.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Wow. Would have been easier if you'd sent a Splunk diag.

0 Karma

the_wolverine
Champion

Here's the tcpdump command that was run at the indexer: /usr/sbin/tcpdump -A -s 1512 host and port 9997

0 Karma

Genti
Splunk Employee
Splunk Employee

Continuing my comment:
Telling the LWF where to send the data should be cheaper (resourcewise) and quite easy. here's an answer with a similar idea: http://answers.splunk.com/questions/5134/can-i-forward-different-data-inputs-to-different-splunk-ind...

0 Karma

the_wolverine
Champion

I'm not here to babysit forwarders 😉 Not Ghetto.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Ghetto. If you had control over the forwarder configs, maybe you could actually be sure it was a LWF.

0 Karma

the_wolverine
Champion

We have data from this host that is going to indexA. I really want to be able to keep my hands off the LWF configuration so I don't have to set those up.

0 Karma

Genti
Splunk Employee
Splunk Employee

instead of doing it with props/transforms, why do you not tell the LWF to send to indexB? Rerouting with props/transforms even if possible should cause slowness in indexing...

0 Karma

the_wolverine
Champion

Simeon, how am I doing IT wrong?

0 Karma

the_wolverine
Champion

Har Har Har, guys.

0 Karma

Simeon
Splunk Employee
Splunk Employee

You are doing IT wrong

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

please provide a complete splunk diag

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!