Getting Data In

Can the universal forwarder route based on field found in the log message?


A file I am monitoring looks something like the following

[timestamp] index=layer1 message="123456"
[timestamp] index=layer2 message="123456"
[timestamp] index=layer3 message="123456"
[timestamp] index=layer3 message="123456"
[timestamp] index=layer1 message="123456"
[timestamp] index=layer1 message="123456"
[timestamp] index=layer2 message="123456"

Can the forwarder somehow use the user specified index field above to route events to corresponding layer1, layer2, layer3 indexes on my indexer?

Tags (3)
0 Karma

Ultra Champion

No. A universal forwarder cannot do that. It has no understanding of fields inside events. In fact, it does not even understand the concept of events. It's just a stream of data.

For that you need to set up a TRANSFORM, where you change the destination index based on event data. These types of operation takes place during the Parsing Phase. Install a Heavy Forwarder on the source system and do your config there, or keep the UF and do it on the Indexer. Read the relevant sections of the documentation:

Hope this helps,


Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...