How do I edit my configuration to assign Websense data to different indexes instead of going to the main index?

[janderson19]

Hello,

I've been trying to get Websense data to go into two different indexes based on whether or not the action was blocked. The reason I am doing this is because Websense is generating ~7GB of data every day, which is too much for the HDDs on the indexer to handle.

I've set up all my .confs in $SPLUNK_HOME/etc/apps/search/local. Here are the relevant lines:

Inputs.conf

[udp://514] 
connection_host = ip 
host = xx.xx.x.xxx 
sourcetype = websense_summary  

props.conf

[host::xx.xx.x.xxx]
NO_BINARY_CHECK = true
TRANSFORMS-websense = setBlockedIndex, setPermittedIndex 

transforms.conf

[setBlockedIndex]
DEST_KEY = MetaData:Index
REGEX = action\s*=\s*blocked
FORMAT = index::WebsenseBlocked

[setPermittedIndex]
DEST_KEY = MetaData:Index
REGEX = .
FORMAT = index::WebsensePermitted 

When I look for the data, it shows up in index=main, instead of the assigned indexes.

[shaskell_splunk · Accepted solution]

I believe you just have a typo in your DEST_KEY and you can strip 'index:' off the FORMAT portion.

DEST_KEY = _MetaData:Index
FORMAT = myindex

See this section from transforms.conf.spec

_MetaData:Index     : The index where the event should be stored.

[Masa]

I agree.
Please keep in mind that host stanza in props.conf cannot be defined by host field in inputs.conf. If you're looking for a certain source ip address who is sending udp packets, you need to specify the source IP.