Getting Data In

Can I use a _meta variable from inputs in a transforms on the same heavy forwarder?



I have a business requirement where I need to index data from multiple of our vendors that also use Splunk.

The vendors have added a _TCP_ROUTING to send data to both our Heavy Forwarders and their own infrastructure.


I have a dedicated port for each vendor in my inputs.conf on the Heavy Forwarder:

disabled = 0
_meta userindex::splunk_test

My idea was to have a different userindex for each input stanza

Next step is a generic props.conf:

TRANSFORMS-force_index = force_index


Finally I was hoping it would be possible to do the magic in my transforms.conf:

DEST_KEY = MetaData:Sourcetype
REGEX = (.+)
SOURCE_KEY = _meta:userindex

I know I'm not rewriting the index, but it is easier to look at the sourcetype, as the events get indexed and it should be a small change to rewrite the index instead of the sourcetype.

Long story... so to the question.

Is it possible to reference the _meta variable I have set in the input stanza in the regex of the transform on the same Heavy Forwarder?


Kind regards




I agree it is a bad idea to rewrite the index, it should be set at the source, but I think it is necessary, as our indexes do not match those of our vendors and I want each vendors data to be indexed in the same index.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!