Forward messages to different indexes based on the value of its field

[myordanov95]

Is it possible to forward messages to different indexes based on the value of message field ?
And which forwarder is the most appropriate (Universal or Heavy) ?

[sudosplunk]

Yes. Using props.conf and transforms.conf, you can achieve this. Please provide some sample data to perform regex matching. Otherwise, below is the basic structure of configuration settings for routing events.

Props.conf:

[your_custom_sourcetype]
TRANSFORMS-routing = routing_based_on_field_values

Transforms.conf:

[routing_based_on_field_values]
REGEX = <your_custom_regex>
DEST_KEY = _MetaData:Index
FORMAT = <alternate_index_name>

You can find more information in below links, let me know if this helps.

http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Setupmultipleindexes#Route_specific_events...

https://answers.splunk.com/answers/566448/route-specific-events-to-a-relative-index.html

[myordanov95]

In case of having a thousands of different values , I want to create thousands of indexes. Does it mean I have to declared thousands of stanzas.

[sudosplunk]

Oh, you want to route each event with different value to a different index? I thought, you want to look for specific value in the raw events and route all the events which have this specific value to different index(s).

[myordanov95]

Yes, I want to forward events with different value to a different indexes.

[sudosplunk]

Can you provide some sample events with values which you want to route.

[myordanov95]

{"name":"value1"},
{"name":"value2"},
....
{"name":"value1000"}

In this case, I want to forward events to 1000 indexes.

[sudosplunk]

Are all these events coming from 1 source/host? Also, why do you want to forward each event to each index.

[myordanov95]

Sorry, I am looking for solution of this problem.