How do I get Splunk to forward syslogs from a certain host to a different Index using the Web GUI?

[sworton]

Hi,

How do I get Splunk to forward syslogs from a certain host to a different Index using the Web GUI?

They are all coming in on port UDP 514 from a Windows forwarder. I want all of this in main apart from syslogs from a certain IP which I want to go into a new index.

It seems to keep complaining that port 514 is already in use which it is but I want

all hosts UDP\514 > main index
x.x.x.x UDP/514 > new index

Thanks for any help, I'm new to this!

Cheers,
Steve.

[mstjohn_splunk]

hi @sworton

Did either of the answers below solve your problem? If so, please resolve approving one of them. If your problem is still not solved, keep us updated so that someone else can help ya. Thanks!

[Rob2520]

https://answers.splunk.com/answers/1026/route-data-to-index-based-on-host.html

https://answers.splunk.com/answers/30585/route-syslog-data-to-specific-index-by-host.html

The above answers should help what you are looking for.

[miwade]

I don't know of any way to do this from the GUI. You may need to get into the backend to update the app.

1) Find where your current inputs.conf file is located on the server. The best place to look is /opt/splunk/etc/apps/search/local/input.conf for linux.

2)Find the stanza that starts like this:

[tcp://:514]

3) Above that put in a new stanza that looks like this.

[tcp://<put server ip here>:514]
index = <new index name here>

4) Restart splunk from the webui

You may need to add or removed fields to get the desired results. Here is the documentation page.
http://docs.splunk.com/Documentation/Splunk/7.2.0/Admin/Inputsconf#inputs.conf.example