Getting Data In

How?: Forward specific syslog events to specific index


We have a VIP setup to load balance and forward all our syslog events to a pair of Non-indexing Splunk Heavy Forwarders. The forwarders then send to a 3rd party IDS as well as a pair of load balanced indexers that are connected to a search head.

We are about to send new syslog data to the VIP and want all data to go to a new index that we created. We would rather NOT create a new listening port on the Forwarders for this new traffic.

How do we send the specific syslog events to the specific index? Would this have to be done on the indexing side?

Thanks in advance for any help.

Tags (3)
1 Solution

0 Karma


We are in the process of setting up a new AV server that has the ability to send events via syslog to Splunk. We do not want this going to the default index as this is not data that we need to retain for a long period of time. Does that answer your question? Thank you in advance for any help.

0 Karma

Path Finder

Before I even take a stab at answering the question ... what makes the data new? Is it from a new source entirely, or are there very specific events that you're looking to change the index on going forward?

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...