Getting Data In

Forward data into 3rd party systems using index instead of host?

christantoy
Path Finder

Good day

i Read this document regarding to the forward data to third-party systems

http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwarddatatothird-partysystemsd#Forward_s...

and my question is can i forward my created index? instead of host?

For example

props.conf

to this

  [host::nyc*]
    TRANSFORMS-nyc = send_to_syslog

Into this

 [index::sample]
    TRANSFORMS-sample = send_to_syslog

transforms.conf

[send_to_syslog]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

output.conf

[syslog:my_syslog_group]
server = loghost.example.com:514

In short i would like to send the contents of the index into other non-splunk systems

Regards
Cris

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Yes. While you can't match against index directly in the stanza, you can put in a default section and then match it in a regex instead by using SOURCE_KEY.

props.conf:

[default]
TRANSFORMS-sampleindex = send_sample_index_to_syslog

transforms.conf:

[send_sample_index_to_syslog]
SOURCE_KEY = _MetaData:Index
REGEX = ^sample$
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

View solution in original post

Ayn
Legend

Yes. While you can't match against index directly in the stanza, you can put in a default section and then match it in a regex instead by using SOURCE_KEY.

props.conf:

[default]
TRANSFORMS-sampleindex = send_sample_index_to_syslog

transforms.conf:

[send_sample_index_to_syslog]
SOURCE_KEY = _MetaData:Index
REGEX = ^sample$
DEST_KEY = _SYSLOG_ROUTING
FORMAT = my_syslog_group

christantoy
Path Finder

Hi again Ayn

can i create a conf file? for output.conf and the other instead? it will work if i do that?

Thanks and Regards
Cris

0 Karma

christantoy
Path Finder

Thank you again!

Forget about the second question. 🙂

BTW my outputs.conf is that correct? do i need to used that?

Regards
Cris

0 Karma

Ayn
Legend

The [default] section can be put in the same props.conf file as other settings you would want to apply. Where it resides doesn't really matter as long as it's in a location where Splunk is seeing and using it.

Re your second question, I'm afraid I don't entirely understand what you mean.

0 Karma

christantoy
Path Finder

Thanks for you answer

But you said that i can put in a default section?
on here splunk > etc > system > default ? i am right?

and but the way i am not much familiar with regex can i done with a default?

Regards Cris

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...