How to change the target index for logs from certain servers with a Windows universal forwarder, but keep the correct sourcetype?

[feisar]

Hi,

I have one Splunk Enterprise server and a number of Windows servers with the Universal forwarder installed and configured to send logs to the server (indexer).

The logs all arrive and get tagged with the index 'wineventlog' and an appropriate sourcetype, 'WinEventLog:Security' or 'WinEventLog:System' etc. - All good stuff.

However, I'd like to change the index for certain servers (as I have done for various switches etc.). I have tried this using props.conf and transforms.conf with rules like this:

props.conf

[host::WINSERVER01]
TRANSFORMS-winevent_dmz = set_index_winevent_dmz

transforms.conf

[set_index_winevent_dmz]
DEST_KEY = _MetaData:Index
FORMAT = winevent_dmz
REGEX = .

But when I do this, although the index does change, the appropriate sourcetype stops being applied and the logs all get assigned a 'splunkd' sourcetype.

Can anyone explain why this happens and let me know the correct way to change the index of logs coming from the Forwarder, but keep the correct sourcetype?

Thanks

[sanjeev543]

I agree with @maciep , if you still want to move to other index at the index time, please check if you can do it by using sourcetype
For example:

props.conf

[WinEventLog:Security]
TRANSFORMS-winevent_dmz = set_index_winevent_dmz

transforms.conf

[set_index_winevent_dmz]
SOURCE_KEY = MetaData:Host
REGEX = (WINSERVER01|WINSERVER02|WINSERVER03....)
DEST_KEY = _Metadata:Index
FORMAT = winevent_dmz

[maciep]

Look like you are applying that change to all data coming from that host. That includes splunk's internal log files. Are you sure that you're not just accidentally sending the _internal data to the winevent_dmz index now? Maybe along with the eventlog data? That would explain the splunkd sourcetype.

Also, it might be easier to just do this from the frowarder on winserver01 in the inputs.conf. Just update the index there. If you have windows app installed, just be sure to make your changes in the local directory instead of default.

[woodcock]

I don't know why it is happening but you can add a sourcetype= directive to your props.conf stanza to force it back.