Heavy forwarder - routing to different indexes depending on field value

[Clovisa]

Hi everyone !

I'm new to Splunk and I'm trying to see what can be done with it. I was wondering if it was possible, with a heavy forwarder, to forward data to different indexes depending on the value of a specific field?

For example, if I have the indexes red_colored_vegetables and green_colored_vegetables, and the following data :

| Id | Vegetable    | Color |
| 1  | Tomato       | Red   |
| 2  | Leek         | Green |
| 3  | Salad        | Green |

I want that 1 is forwarded to the index red_colored_vegetables and that 2 and 3 are forwarded to the index green_colored_vegetables.
Is it feasible?

Thanks !

[hortonew · Accepted solution]

I think this should get you close to what you want:

inputs.conf
[monitor://...]
index=vegetables
sourcetype=vegetables
disabled=false

transforms.conf
[rewrite_red]
DEST_KEY =_MetaData:Index
REGEX = (?i)red
FORMAT = red_colored_vegetables

[rewrite_green]
DEST_KEY =_MetaData:Index
REGEX = (?i)green
FORMAT = green_colored_vegetables

props.conf
[vegetables]
TRANSFORMS-veggieindex = rewrite_red, rewrite_green