How to indexing single data to multiple index in one splunk server?

[zakxu8]

Hi, can someone help me

I want indexing single data to multiple indexer, i have try edit

props.conf

[top]
TRANSFORMS-routing = customer1,customer2

and i have edit

transforsm.conf

[customer1]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = test

[customer2]
SOURCE_KEY = MetaData:Sourcetype
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = os

so just on index=os [customer2] data arrived on my splunk.

somebody can help me? I use Splunk 6.5.1
Thank You

[hunters_splunk]

Hi zakxu8,

REGEX identifies the events from the SOURCE_KEY that will be processed. In your case, you must specify the regex that captures the events that you want to reroute (customer1 and customer2).
I don't know your data structure, but here is an example you can try, assuming that you have a key named customerId to distinguish customer1 from customer2.

props.conf

[mysrctype]
TRANSFORMS-customer1 = route_customer1
TRANSFORMS-customer2 = route_customer2

transforms.conf

[route_customer1]
REGEX = customerId:customer1
DEST_KEY = _MetaData:Index
FORMAT = index_customer1

[route_customer2]
REGEX = customerId:customer2
DEST_KEY = _MetaData:Index
FORMAT = index_customer2

Hope it helps. Thanks!
Hunter

[zakxu8]

hi Hunter,

Thx for your answer but i still can't.

this my transforms.conf

[route_top1]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = os

[route_top2]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = apaaja

i think my regex should be the same one and another, because the data that i want to get into Splunk is data from "Top" command in linux. So i'm still confusing why Splunk only get the data into the "apaaja" index instead two both of the index that i made. it's look like the transfroms only replace the original index from inputs.conf which is index=os.