Can I override an index name at indexer?

[khin]

Hi, I have a set up where an UF is sending data into HF. From HF, the data is supposedly to be sent to two different indexers with different indexes. For example, indexer01 receives the data with indexA while indexer02 receives the same data with indexB. 

This is what I have tried so far, but not working.  However the data flow is correct and sending the same data to both indexers with the predefined indexA from UF.

inputs.conf (UF)

[monitor:///home/name/samplelogs]
disabled = false
index = indexA
sourcetype = sourcetypeA

inputs.conf (HF)

[splunktcp://9997]

outputs.conf (HF)

[tcpout]
defaultGroup = indexer01, indexer02
[tcpout:indexer01]
server=indexer01_IP
[tcpout:indexer02]
server=indexer02_IP

inputs.conf (indexer02)

[splunktcp://9997]
index=indexA
queue=parsingQueue

props.conf (indexer02)

[sourcetypeA] (or) [host::UF_hostname] (or) [source::/home/name/samplelogs]
TRANSFORMS-index = overrideindex

transforms.conf (indexer02)

[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = .
FORMAT = indexB

 Any help would be appreciated!  Thanks!

[PickleRick]

You can't overwrite the index at indexer level in your case. Data is parsed st HF level and indexers only receive it and write to indexes, they don't process it anymore. An event is only processed once - on the first "heavy" component in event's path.

So if you want to send the event to different indexes on different indexers you'd have to do something more complicated - use CLONE_SOURCETYPE to duplicate an event with a new sourcetype and for that sourcetype overwrite an index, probably overwrite sourcetype back to the original one and route to proper output.

Why would you want to send the event to two different indexes on two different indexers in the first place? It's gonna count twice against your licenses.

[khin]

Hi PickleRick, thank you for the fast reply.

It is because the two indexers are from different environments and they want their indexes to be named accordingly.

Could you elaborate further on cloning the sourcetype? An example will be a lot of help. Thanks!

[PickleRick]

I haven't used CLONE_SOURCETYPE myself (didn't have the need for that).

But you can read about it here: https://conf.splunk.com/files/2020/slides/PLA1154C.pdf