Getting Data In

How to configure Splunk to distinguish different types of logs from syslog and save them in different indexes on a Splunk Indexer?

New Member

I have just installed a Splunk App where the logs are from some appliances, so obviously they are sending syslog to our Splunk Indexer. However, this Splunk App is only suitable for analyzing specific logs of one of the vendor appliances (vendor specific Splunk App). So, the problem is that I configured all my network devices (i.e. switch, router, firewall, etc) to send syslog to our Splunk Indexer where the Splunk Indexer stores these logs in the "main" Index.

So, how do I tell the newly installed Splunk App to only capture the "needed" logs to perform analysis from the pool of logs in the "Main" index? (The "need to analyze" logs are in the pool of logs stored in "Main" Index)

Tags (3)
0 Karma


Hi charlescywong,

another approach is to re-write the sourcetype of your syslog inputs based on the hostname in the events. This will allow you to send everything over syslog and still have those vendor specific syslog source types in the events.

You can achieve this by using props.conf and transforms.conf on your Splunk instance which does the parsing (Either an Indexer or a heavy weight forwarder).

This example will re-write the sourcetype for events which were send from the host CiscoNetWorkDevice to be cisco_syslog:


TRANSFORMS-001_syslog_set_sourcetype = 001_syslog_set_sourcetype


SOURCE_KEY = MetaData:Host
REGEX = CiscoNetWorkDevice
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::cisco_syslog

Hope this helps and you can get this working ...

cheers, MuS

0 Karma

New Member

Does this mean re-direct the syslog from CiscoNetworkDevice to cisco_syslog while data is getting into the Splunk Indexer?

0 Karma


It's not really re-direct, the sourcetype will be changed from syslog to cisco_syslog but only for events from host CiscoNetWorkDevice everything else stays sourcetype syslog. You can setup multiple transforms to re-wirte the source types for other devices as well.
Done that multiple times and works perfect.

0 Karma

Ultra Champion

The categorization of data is done via the index and the sourcetype. If you deal with syslogs, you better check whether your logs conform to the pretrained syslogs described at List of pretrained source types

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...