How?: Forward specific syslog events to specific index

[I-Man]

We have a VIP setup to load balance and forward all our syslog events to a pair of Non-indexing Splunk Heavy Forwarders. The forwarders then send to a 3rd party IDS as well as a pair of load balanced indexers that are connected to a search head.

We are about to send new syslog data to the VIP and want all data to go to a new index that we created. We would rather NOT create a new listening port on the Forwarders for this new traffic.

How do we send the specific syslog events to the specific index? Would this have to be done on the indexing side?

Thanks in advance for any help.

[Ayn]

Did you read the docs on this? http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad

[sdaniels · Accepted solution]

I think this will help you.

http://splunk-base.splunk.com/answers/34251/udp514-and-source-types

Previous answer on this topic:

http://splunk-base.splunk.com/answers/38547/sending-certain-logs-from-udp-port-514-to-specific-index...

[I-Man]

We are in the process of setting up a new AV server that has the ability to send events via syslog to Splunk. We do not want this going to the default index as this is not data that we need to retain for a long period of time. Does that answer your question? Thank you in advance for any help.

[iunderwood]

Before I even take a stab at answering the question ... what makes the data new? Is it from a new source entirely, or are there very specific events that you're looking to change the index on going forward?