Getting Data In

How to override an index on per event basis?

Haybuck15
Explorer

So basically, I have a ton of events coming in on UDP 514. Based on the document linked below, I was able
to configure my Sourcetype Overrides so not everything comes in as "Palo Alto". However, now my 3PAR Storage Array logs are coming in as:

sourcetype = 3par_array
index = network

I'd like to override my Index field based on the Regex I configured for Sourcetype Overrides, however Splunk says that "DestKey = Index" is undefined. Could someone please help me out?

http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Advancedsourcetypeoverrides

0 Karma
1 Solution

woodcock
Esteemed Legend

It is poor practice to syslog directly into Splunk; you should use a Universal Forwarder with a syslog aggregator as described here:

http://www.georgestarcher.com/splunk-success-with-syslog/

0 Karma

woodcock
Esteemed Legend

You misunderstand me; the Heavy Forwarder should be a Universal Forwarder and should be running syslog-ng with a filter for each appliance to filter out the sourcetypes to disk directories.

0 Karma

Haybuck15
Explorer

@woodcock - This is routing to the Heavy Forwarder and being parsed there; this is an appliance that can not have a Universal Forwarder on it, similar to a Palo Alto firewall.

@somesoni2 - That did the trick, thank you.

0 Karma
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...