Getting Data In
Highlighted

How to indexing single data to multiple index in one splunk server?

New Member

Hi, can someone help me

I want indexing single data to multiple indexer, i have try edit

props.conf

[top]
TRANSFORMS-routing = customer1,customer2

and i have edit

transforsm.conf

[customer1]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = test

[customer2]
SOURCEKEY = MetaData:Sourcetype
REGEX = .
DEST
KEY = _MetaData:Index
FORMAT = os

so just on index=os [customer2] data arrived on my splunk.

somebody can help me? I use Splunk 6.5.1
Thank You

0 Karma
Highlighted

Re: How to indexing single data to multiple index in one splunk server?

Splunk Employee
Splunk Employee

Hi zakxu8,

REGEX identifies the events from the SOURCE_KEY that will be processed. In your case, you must specify the regex that captures the events that you want to reroute (customer1 and customer2).
I don't know your data structure, but here is an example you can try, assuming that you have a key named customerId to distinguish customer1 from customer2.

props.conf

[mysrctype]
TRANSFORMS-customer1 = route_customer1
TRANSFORMS-customer2 = route_customer2

transforms.conf

[route_customer1]
REGEX = customerId:customer1
DEST_KEY = _MetaData:Index
FORMAT = index_customer1

[route_customer2]
REGEX = customerId:customer2
DEST_KEY = _MetaData:Index
FORMAT = index_customer2

Hope it helps. Thanks!
Hunter

0 Karma
Highlighted

Re: How to indexing single data to multiple index in one splunk server?

New Member

hi Hunter,

Thx for your answer but i still can't.

this my transforms.conf

[routetop1]
REGEX = .
DEST
KEY = _MetaData:Index
FORMAT = os

[routetop2]
REGEX = .
DEST
KEY = _MetaData:Index
FORMAT = apaaja

i think my regex should be the same one and another, because the data that i want to get into Splunk is data from "Top" command in linux. So i'm still confusing why Splunk only get the data into the "apaaja" index instead two both of the index that i made. it's look like the transfroms only replace the original index from inputs.conf which is index=os.

0 Karma