Forwarding data for only selected hosts

[brianm1002]

I have one splunk indexer that receives data from a variety of hosts. I want to also forward the data coming in from about 3-4 of these hosts to a second Splunk indexer, while also indexing the data on the first indexer. All the hosts I want to forward happen to be coming in through syslog, but that might not always be true.

This is what I have on the first indexer:

In props.conf:

[host::host1.xxxxxxx.xxx] 
TRANSFORMS-routing=InfoSecRouting 
[host::host2.xxxxxxx.xxx] 
TRANSFORMS-routing=InfoSecRouting 
[host::host3.xxxxxxx.xxx] 
TRANSFORMS-routing=InfoSecRouting 
[host::host4.xxxxxxx.xxx] 
TRANSFORMS-routing=InfoSecRouting 
[host::host5.xxxxxxx.xxx] 
TRANSFORMS-routing=InfoSecRouting 

In transforms.conf:

[InfoSecRouting] 
REGEX = . 
DEST_KEY=_TCP_ROUTING 
FORMAT=InfoSecGroup

In outputs.conf:

[tcpout] 
defaultGroup=none 
indexAndForward=true 

[tcpout:InfoSecGroup] 
server=10.110.70.183:9002

On the second indexer, I have the following in inputs.conf:

[default]
host = indexer2

[splunktcp://9002]
index = operations

This doesn't seem to be working. The first indexer is still indexing these hosts, but nothing is being forwarded to the second indexer. I came up with these settings based on the forwarding and routing section of the Splunk manual.

Thanks, Brian

[hazekamp]

This could be an order of operations issue with respect to when the value of "host" is being set. Out of curiousity are you using Splunk forwarders? If "host" is also being set via index-time TRANSFORMS property (which is often the case for direct syslog input), you may have to specify your TRANSFORMS to run on your source input and specify the values of "host" in the REGEX.

For instance:

## props.conf
[source::udp:514]
TRANSFORMS-routing_for_syslog = InfoSecRouting_syslog

## transforms.conf
[InfoSecRouting_syslog] 
REGEX = \w{3}\s+\d+\s+\d{2}:\d{2}\d{2}\s+(host1.xxxxxxx.xxx|host2.xxxxxxx.xxx)
DEST_KEY=_TCP_ROUTING 
FORMAT=InfoSecGroup

## For reference this is the $SPLUNK_HOME/etc/system/default/transforms.conf for syslog-host
[syslog-host]
DEST_KEY = MetaData:Host
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?)\.\w+\s+)*\[?(\w[\w\.\-]{2,})\]?\s
FORMAT = host::$1