Splunk Dev

Reroute data that is marked for an index?

the_wolverine
Champion

I have syslog-ng data coming from LWFs that have been earmarked for indexA. I want to intercept these events and reroute them to another index called indexB. It doesn't seem to be working. Am I missing something basic?

The sourcetype is syslog so in props I have:

[syslog]
TRANSFORMS-route = route2indexB

transforms.conf:

[route2indexB]
REGEX=(192.168.1.12)
DEST_KEY = _MetaData:Index
FORMAT = indexB

I've tried multiple iterations of this configuration including using source and host in props.conf. I can't seem to get the data to go to indexB.

0 Karma
1 Solution

the_wolverine
Champion

Turns out the LWF was not a LWF. It was a heavyweight forwarder 🙂

Thanks to Raitz for figuring that out. He spotted the _linebreaker in the tcpdump output which is an indication of cooked data.

I had the system owner enable LWF from CLI and all is working as expected.

View solution in original post

the_wolverine
Champion

Turns out the LWF was not a LWF. It was a heavyweight forwarder 🙂

Thanks to Raitz for figuring that out. He spotted the _linebreaker in the tcpdump output which is an indication of cooked data.

I had the system owner enable LWF from CLI and all is working as expected.

gkanapathy
Splunk Employee
Splunk Employee

Wow. Would have been easier if you'd sent a Splunk diag.

0 Karma

the_wolverine
Champion

Here's the tcpdump command that was run at the indexer: /usr/sbin/tcpdump -A -s 1512 host and port 9997

0 Karma

Genti
Splunk Employee
Splunk Employee

Continuing my comment:
Telling the LWF where to send the data should be cheaper (resourcewise) and quite easy. here's an answer with a similar idea: http://answers.splunk.com/questions/5134/can-i-forward-different-data-inputs-to-different-splunk-ind...

0 Karma

the_wolverine
Champion

I'm not here to babysit forwarders 😉 Not Ghetto.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Ghetto. If you had control over the forwarder configs, maybe you could actually be sure it was a LWF.

0 Karma

the_wolverine
Champion

We have data from this host that is going to indexA. I really want to be able to keep my hands off the LWF configuration so I don't have to set those up.

0 Karma

Genti
Splunk Employee
Splunk Employee

instead of doing it with props/transforms, why do you not tell the LWF to send to indexB? Rerouting with props/transforms even if possible should cause slowness in indexing...

0 Karma

the_wolverine
Champion

Simeon, how am I doing IT wrong?

0 Karma

the_wolverine
Champion

Har Har Har, guys.

0 Karma

Simeon
Splunk Employee
Splunk Employee

You are doing IT wrong

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

please provide a complete splunk diag

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...