Dashboards & Visualizations

splunk connect - Send one namespace logs to separate index

m_k_90
New Member

I would want to send logs from one namespace to a separate index where all other logs are send out to one index. I am using  splunk-connect HEC to forward that from the openshift cluster. Can anyone guide how it can be done?

I tried indexRouting=true and adding a local splunk in values file of helm chart. But, i observe token stored in env is only for local and the global value seems to give an error   --> "text":"Incorrect index","code":7,"invalid-event-number":1} "

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...