Hello,
We have a setup where we share some data with our partner, so we have set up two different groups in outputs.conf
, call them ourGroup
and theirGroup
. Then in inputs.conf
, we set the _TCP_ROUTING
to send to both groups. So far, so good.
Now it transpires that our partner would prefer a different naming convention for the index. I've looked at props.conf
and transforms.conf
, but it doesn't seem possible to change the index name, based on the tcpout
-group. I'm not even sure if this is available on the UF.
So option 1 is to have multiple stanzas in inputs.conf
for each source, with a different _TCP_ROUTING
in each stanza. So, will there be a performance hit on the host with the UF installed? Especially interested in the Windows event log facility and how this would cope with several input stanzas.
Option 2, I guess, is to implement this in the receiving indexers. Whether I want to do this, I'm not completely sure. It would probably have to be our indexers. Our partner would have to implement several stanzas in props.conf
, based on the host.
Hello
Option 1 won't work, you can't have multiple inputs to the same path, it will use only one of them.
The second option is the right one, leave the input without index configuration. And in the indexers use transforms to modify the index dynamically based on the sourcetype. See:
http://answers.splunk.com/answers/8531/routing-to-index-based-on-host-etc.html
Regards
Hello
Option 1 won't work, you can't have multiple inputs to the same path, it will use only one of them.
The second option is the right one, leave the input without index configuration. And in the indexers use transforms to modify the index dynamically based on the sourcetype. See:
http://answers.splunk.com/answers/8531/routing-to-index-based-on-host-etc.html
Regards
Thanks! I guessed as much. An additional implied, but not articulated, question was: is there any way of doing this on the Universal Forwarder (using single stanzas)?