Getting Data In

Different IIS hosts logging to different indexes

erikwie
Path Finder

We got several IIS servers and want to index IIS logs into Splunk. However, we need to seperate some of the servers to a seperate indexer due to different needs for Access controll and retention.

Is there a way to get IIS logs from some servers to one index and logs from anorther server to another index?

Using universal forwarders. running Splunk 7.2.6 , Windows 2012RS, single instance.

0 Karma
1 Solution

woodcock
Esteemed Legend

You should not be using separate indexers, you should be using separate index values on the same indexer and using roles-based access feature to control who gets to use/see what. Hopefully that is what you meant. You can do it the hard way at the indexers like this:
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
Or you can do it the easy way by either:
1: creating 2 apps and deploying one with index=foo to 1 class of servers and the other with index=bar to the other class.
2: using a single app and creating a set of universal host-based stanzas to the appropriate UFs like this:

[host::foo1]
index = foo
[host::foo2]
index = foo
[host::foo3]
index = foo
[host::foo4]
index = foo
[host::bar1]
index = bar
[host::bar2]
index = bar
[host::bar3]
index = bar
[host::bar4]
index = bar

View solution in original post

woodcock
Esteemed Legend

You should not be using separate indexers, you should be using separate index values on the same indexer and using roles-based access feature to control who gets to use/see what. Hopefully that is what you meant. You can do it the hard way at the indexers like this:
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad
Or you can do it the easy way by either:
1: creating 2 apps and deploying one with index=foo to 1 class of servers and the other with index=bar to the other class.
2: using a single app and creating a set of universal host-based stanzas to the appropriate UFs like this:

[host::foo1]
index = foo
[host::foo2]
index = foo
[host::foo3]
index = foo
[host::foo4]
index = foo
[host::bar1]
index = bar
[host::bar2]
index = bar
[host::bar3]
index = bar
[host::bar4]
index = bar

wmyersas
Builder

OP said "indexes", not "indexers"

0 Karma

woodcock
Esteemed Legend

I think somebody edited and fixed it.

0 Karma

wmyersas
Builder

You can use different server classes (with associated different inputs.conf) going to IIS servers of Type A vs Type B

Yes, you do need to maintain two (or more) UF apps, but you can get pretty granular on what endpoints show up in what server class

gcusello
SplunkTrust
SplunkTrust

HI @erikwie,
You have to override index value for some events on Indexers not on Universal Forwarders.

Following the infos at https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Data/Advancedsourcetypeoverrides
in props.conf

[host::your_host]
TRANSFORMS-index = overrideindex

(a stanza for each host or you can use jolly chars)

in transforms.conf

[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = .
FORMAT = my_new_index

Ciao.
Giuseppe

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...