Getting Data In

Direct to an index based on _raw

daniel333
Builder

All,

I am looking to route data to an index based on contents of the _raw.

Basically I have app that runs every so often and logs to /var/log/message on a Linux system. If i see "arpwatch" in the text I want the event to end up in index=arpwatch.

Assuming I don't want to mess with the logging facilities at this time to create another log file. Is this something Splunk can do?

Here is what I have so far on my all in one box. It sorta works, but I am getting the hostname AND index overwritten to be arpwatch rather than just the index.

props.conf
[syslog]
BREAK_ONLY_BEFORE = ^
TRANSFORMS-indexrouting = arpwatch

transforms.conf
[arpwatch]
REGEX = (?i) .app=arpwatch.
DEST_KEY = _MetaData:Index
FORMAT = arpwatch

0 Karma
1 Solution

daniel333
Builder

Restarted Splunk and problem went away. Not sure what was up there, but it's working now.

View solution in original post

0 Karma

daniel333
Builder

Restarted Splunk and problem went away. Not sure what was up there, but it's working now.

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...