Getting Data In

Can we change index in the indexer?

roysoman
Engager

Our heavy forwarder is forwarding logs to the Indexer. All the logs are going to the main Index. In the indexer level, is it possible to change Props.conf and /transforms.conf to send the logs to a different(alternate) index based on the Host? I put the below changes in the indexer conf files which is not working. Same config changes works from heavy forwarder, but I am having a different issue when I put it in the Heavy forwarder. From Heavy forwarder its duplicating the messages into both main and Newindex. So I am trying to put directly into indexer, which is not working 😞

in props.conf

[host::(IPaddress]
TRANSFORMS = rewrite-DPindex

in transforms.conf

[rewrite-DPindex]
REGEX = .*
DEST_KEY = _MetaData:Index
FORMAT = NewIndex
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi roysoman,
at first, are you sure that ip address is the real hostname of the host that you want to redirect?
Anyway this configuration must be at Heavy Forwarder level.

In general, I suggest to manage this different index addressing at Universal Forwarder level, using Deployment Server and creating two ServerClasses: one for this host and one for the others.
Each serverClass has its own Technical Add-On with the correct index addressing.
So you don't need to override index definition and you haven'0t any duplication.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...