Getting Data In

How to direct incoming data on universal forwarder to desired index ?

ronak
Path Finder

My Setup

I've an index by the name mobile_client1_venue1 that gets data from mobile client application that sends events to a Universal Forwarder's (say UF1) TCP port. The event contains two default attributes in addition to many other. These attributes are client_id, venue_id (for example 1,1 ; 2,103; 2,104 ; 3,109 etc)

When I've a new client say client_2_venueX; the mobile app used there will send data to the same UF1 and same TCP port, BUT the event will have client_id, venue_id combination of 2,103

I also have another index mobile_client2_venue1

Need

What can I do so that events appearing on the same UF can be directed to index mobile_client1_venue1 where (client_id, venue_id) combination is 1,1 ; and to index mobile_client2_venue1 where (client_id, venue_id) combination is 2,103

Thus I want to send the incoming events to different index based on the content of the event ...logically speaking,

if incoming event has client_id , venue_id combination = 1,1 then
send event to index = mobile_client1_venue1
if incoming event has client_id , venue_id combination = 2,103 then
send event to index = mobile_client2_venue1
else
send even to index=mobile_genetic_fetch_all
end if;

Any pointers would be greatly appreciated

Tags (1)
0 Karma
1 Solution

jayannah
Builder

Hope the below configuration should give u some pointer (Not tested)

props.conf
[ < source-type OR source OR host > ]
TRANSFORMS-multiroute=default_index, c1_venue1, c2_venue2

transforms.conf
[default_index]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = mobile_genetic_fetch_all

[c1_venue1]
REGEX = < rex >
DEST_KEY = _MetaData:Index
FORMAT = mobile_client1_venue1

[c2_venue1]
REGEX = < rex >
DEST_KEY = _MetaData:Index
FORMAT = mobile_client2_venue1

View solution in original post

0 Karma

jayannah
Builder

Hope the below configuration should give u some pointer (Not tested)

props.conf
[ < source-type OR source OR host > ]
TRANSFORMS-multiroute=default_index, c1_venue1, c2_venue2

transforms.conf
[default_index]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = mobile_genetic_fetch_all

[c1_venue1]
REGEX = < rex >
DEST_KEY = _MetaData:Index
FORMAT = mobile_client1_venue1

[c2_venue1]
REGEX = < rex >
DEST_KEY = _MetaData:Index
FORMAT = mobile_client2_venue1

0 Karma

jayannah
Builder

Is this worked or still facing issue?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...