Deployment Architecture

Windows EventLogs

mileven
Explorer

Is it possible to send specific EventCodes to a different index other than the specified index. I want to send some application specific EventCodes to an application specific index that is not the default EventLog index.

For example.

EventCode 1-1000 goto index A
EventCode 10000-11000 go to index b

Is this possible?

0 Karma

Adrian
Path Finder

To answer your question... Yes, it is possible. This is the documentation you require: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes#Route\_specific\_eve...

You would have to modify your REGEX statement in your transforms.conf to grab the events you require:

   [<transforms_A>]
    REGEX = EventCode:([0-9]{1,3}|1000)
    DEST_KEY = _MetaData:Index
    FORMAT = indexA

    [<transforms_B>]
    REGEX = EventCode:1(0[0-9]{3}|1000)
    DEST_KEY = _MetaData:Index
    FORMAT = indexB

You might have to play around with the regex statements provided in example

aelliott
Motivator

aelliott
Motivator

also see the part that says "Route specific events to a different index" here: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...