Deployment Architecture

Windows EventLogs

mileven
Explorer

Is it possible to send specific EventCodes to a different index other than the specified index. I want to send some application specific EventCodes to an application specific index that is not the default EventLog index.

For example.

EventCode 1-1000 goto index A
EventCode 10000-11000 go to index b

Is this possible?

0 Karma

Adrian
Path Finder

To answer your question... Yes, it is possible. This is the documentation you require: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes#Route\_specific\_eve...

You would have to modify your REGEX statement in your transforms.conf to grab the events you require:

   [<transforms_A>]
    REGEX = EventCode:([0-9]{1,3}|1000)
    DEST_KEY = _MetaData:Index
    FORMAT = indexA

    [<transforms_B>]
    REGEX = EventCode:1(0[0-9]{3}|1000)
    DEST_KEY = _MetaData:Index
    FORMAT = indexB

You might have to play around with the regex statements provided in example

aelliott
Motivator

aelliott
Motivator

also see the part that says "Route specific events to a different index" here: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...