Getting Data In

How can I override an index name based on sourcetype?

rphillips_splk
Splunk Employee
Splunk Employee

I want to override the index name of my events (assigned at the forwarder) with a new index name based on sourcetype.

1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

This can be done at the heavy forwarder or indexer:

On your indexer or heavy forwarder:

# etc/system/local/transforms.conf 
[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = .
FORMAT = my_new_index


#etc/system/local/props.conf 
[mysourcetype]
TRANSFORMS-index = overrideindex

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

This can be done at the heavy forwarder or indexer:

On your indexer or heavy forwarder:

# etc/system/local/transforms.conf 
[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = .
FORMAT = my_new_index


#etc/system/local/props.conf 
[mysourcetype]
TRANSFORMS-index = overrideindex

rphillips_splk
Splunk Employee
Splunk Employee

you must have the index already configured on the indexers in indexes.conf before sending events to the new index.

shan_santosh
Explorer

Can I do this based on specific host name, if yes, how?

0 Karma

MuS
Legend

Greetings from the future ...

Yes, you can specify a host name to be used in props.conf see the docs for more details https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#GLOBAL_SETTINGS

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...