Getting Data In

How can I override an index name based on sourcetype?

rphillips_splk
Splunk Employee
Splunk Employee

I want to override the index name of my events (assigned at the forwarder) with a new index name based on sourcetype.

1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

This can be done at the heavy forwarder or indexer:

On your indexer or heavy forwarder:

# etc/system/local/transforms.conf 
[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = .
FORMAT = my_new_index


#etc/system/local/props.conf 
[mysourcetype]
TRANSFORMS-index = overrideindex

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

This can be done at the heavy forwarder or indexer:

On your indexer or heavy forwarder:

# etc/system/local/transforms.conf 
[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = .
FORMAT = my_new_index


#etc/system/local/props.conf 
[mysourcetype]
TRANSFORMS-index = overrideindex

rphillips_splk
Splunk Employee
Splunk Employee

you must have the index already configured on the indexers in indexes.conf before sending events to the new index.

shan_santosh
Explorer

Can I do this based on specific host name, if yes, how?

0 Karma

MuS
Legend

Greetings from the future ...

Yes, you can specify a host name to be used in props.conf see the docs for more details https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#GLOBAL_SETTINGS

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...