Getting Data In

How to override an index on per event basis?

Haybuck15
Explorer

So basically, I have a ton of events coming in on UDP 514. Based on the document linked below, I was able
to configure my Sourcetype Overrides so not everything comes in as "Palo Alto". However, now my 3PAR Storage Array logs are coming in as:

sourcetype = 3par_array
index = network

I'd like to override my Index field based on the Regex I configured for Sourcetype Overrides, however Splunk says that "DestKey = Index" is undefined. Could someone please help me out?

http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Advancedsourcetypeoverrides

0 Karma
1 Solution

woodcock
Esteemed Legend

It is poor practice to syslog directly into Splunk; you should use a Universal Forwarder with a syslog aggregator as described here:

http://www.georgestarcher.com/splunk-success-with-syslog/

0 Karma

woodcock
Esteemed Legend

You misunderstand me; the Heavy Forwarder should be a Universal Forwarder and should be running syslog-ng with a filter for each appliance to filter out the sourcetypes to disk directories.

0 Karma

Haybuck15
Explorer

@woodcock - This is routing to the Heavy Forwarder and being parsed there; this is an appliance that can not have a Universal Forwarder on it, similar to a Palo Alto firewall.

@somesoni2 - That did the trick, thank you.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...