Getting Data In

Different index based on hostname

ebastos
Explorer

Hi, All.

I'm trying to send specific hostnames to a different index, but not making a lot of progress.
We have 2 forwarders (splunkforwarder), 1 indexer and 1 search head.

I've put the following configs under $SPLUNK_HOME/etc/system/local/

props.conf:

[host::*.mpls.domain.com]
TRANSFORMS-index = mpls

transforms.conf:

[mpls]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = mpls

Restarted splunk, but data keeps going to the main index.
Any ideas how I can troubleshoot that, please?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Your configuration looks correct. Where is it applied? It needs to be on the indexer. I would use btool to make sure the configuration is coming out like expected:

splunk cmd btool --debug props list "host::*.mpls.domain.com"
splunk cmd bootl --debug transforms list "mpls"

ebastos
Explorer

Good news is that the debug command works.
Bad news is that I still don't see why it's not working. 🙂

The files are indeed on the indexer.

/opt/splunk/etc/system/local/transforms.conf [mpls]
/opt/splunk/etc/system/local/transforms.conf DEST_KEY = _MetaData:Index
/opt/splunk/etc/system/local/transforms.conf FORMAT = mpls
/opt/splunk/etc/system/local/transforms.conf REGEX = .

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...