Getting Data In

How can I route os data from one set of indexers to another set of indexers?

saurabh_ti
Engager

Hi,

We need to route os data from one set of indexers to another set of indexers,but while using the below settings all the data from our indexers are getting routed to other set of indexers (testServers).
=======Transforms.conf======

[fleet]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT=testServers

=======Props.conf======

[top]
TRANSFORMS-routing=fleet

[iostat]
TRANSFORMS-routing=fleet

[vmstat]
TRANSFORMS-routing=fleet

[interfaces]
TRANSFORMS-routing=fleet

[cpu]
TRANSFORMS-routing=fleet

[df]
TRANSFORMS-routing=fleet

[hardware]
TRANSFORMS-routing=fleet

[version]
TRANSFORMS-routing=fleet

=======Outputs.conf======

[tcpout:testServers]
server= testServer.com:9997

We are routing the os data coming from our universal forwarders, using heavy forwarders. But here we need to route the os data of our indexers to another set of indexers. The above settings is not working in this case.

Any help is appreciated.

Thanks

0 Karma

valiquet
Contributor

You need to add another set of server groups in outputs.conf
Put the test under [default].

Then in inputs.conf using _TCP_ROUTING you can select your other set of Indexeur

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!