Getting Data In

Change index depending on host

pbalbasdtt
Path Finder

Hi all,

I'm trying to split Windows events into different indexes at index time depending on the host which is sending them. Below there are my props.conf and transforms.conf

  • props.conf:
    [WMI:WinEventLog:Security]
    TRANSFORMS-set_new_index = set_index_new

  • transforms.conf
    [set_index_new]
    REGEX = MY.HOSTNAME.12.COM
    FORMAT = windows-new
    DEST_KEY = _MetaData:Index

I tried with different combinations on the regex but none of them worked. Can someone tell me what could be wrong? Thanks in advance.

Best.

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

1) Your transforms does not say which field you are trying to match (SOURCE_KEY). If you don't tell it that, then it probably is checking the entire _raw, iirc.

2) If you mean to match only the character ., then your regex should escape the character using \.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

1) Your transforms does not say which field you are trying to match (SOURCE_KEY). If you don't tell it that, then it probably is checking the entire _raw, iirc.

2) If you mean to match only the character ., then your regex should escape the character using \.

0 Karma

pbalbasdtt
Path Finder

The 2nd one works!!! Thanks a lot for your answer

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

On which splunk instance, have you configured above props.conf and transforms.conf ? It should be on first Splunk Enterprise instance from Universal Forwarder. For example: If UF sends data to Heavy Forwarder and then it goes to Indexer then you need to configure props & transforms on Heavy Forwarder. If UF sends data directly to Indexer then you need to configure props & transforms on Indexer.

pbalbasdtt
Path Finder

Hi,

Thanks for your response. I have a UF sending logs to indexers. I deployed those .conf files on indexers but it's not indexing logs on the new index, and it is using the old one.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Have you restarted splunk on Indexer after adding those props/transforms ?

0 Karma

pbalbasdtt
Path Finder

I deployed the changes via Cluster Master, so I assume no restart on IDX is required, is that right?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Yes if you deployed from CM then it will automatically take care. Additionally only new data will go into new index not existing data. If that is still not working then I'll suggest to provide some sample data (Mask sensitive data)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...