Getting Data In

Forward data into 3rd party systems using index instead of host?

christantoy
Path Finder

Good day

i Read this document regarding to the forward data to third-party systems

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwarddatatothird-partysystemsd#Forward_s...

and my question is can i forward my created index? instead of host?

For example

props.conf

to this

  [host::nyc*]
    TRANSFORMS-nyc = send_to_syslog

Into this

 [index::sample]
    TRANSFORMS-sample = send_to_syslog

transforms.conf

[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

output.conf

[syslog:my_syslog_group]
server = loghost.example.com:514

In short i would like to send the contents of the index into other non-splunk systems

Regards
Cris

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Yes. While you can't match against index directly in the stanza, you can put in a default section and then match it in a regex instead by using SOURCE_KEY.

props.conf:

[default]
TRANSFORMS-sampleindex = send_sample_index_to_syslog

transforms.conf:

[send_sample_index_to_syslog]
SOURCE_KEY = _MetaData:Index
REGEX = ^sample$
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

View solution in original post

Ayn
Legend

Yes. While you can't match against index directly in the stanza, you can put in a default section and then match it in a regex instead by using SOURCE_KEY.

props.conf:

[default]
TRANSFORMS-sampleindex = send_sample_index_to_syslog

transforms.conf:

[send_sample_index_to_syslog]
SOURCE_KEY = _MetaData:Index
REGEX = ^sample$
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

christantoy
Path Finder

Hi again Ayn

can i create a conf file? for output.conf and the other instead? it will work if i do that?

Thanks and Regards
Cris

0 Karma

christantoy
Path Finder

Thank you again!

Forget about the second question. 🙂

BTW my outputs.conf is that correct? do i need to used that?

Regards
Cris

0 Karma

Ayn
Legend

The [default] section can be put in the same props.conf file as other settings you would want to apply. Where it resides doesn't really matter as long as it's in a location where Splunk is seeing and using it.

Re your second question, I'm afraid I don't entirely understand what you mean.

0 Karma

christantoy
Path Finder

Thanks for you answer

But you said that i can put in a default section?
on here splunk > etc > system > default ? i am right?

and but the way i am not much familiar with regex can i done with a default?

Regards Cris

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...