How to reroute events from TCP routed index to a different index

[splunkreal]

Hello, we receive data using _TCP_ROUTING from forwarders from another team using another Splunk cluster.

We don't use same indexes.

Instead of routing data based on source or host we receive on our indexers, is it possible to route data from one index (specified in their inputs.conf) to our own index? Especially what would be the props.conf stanza?

Thanks.

[PickleRick]

The only thing that could work (but I haven't done this myself) is to use ingest actions. You'd need to use ingest actions to rewrite index on already parsed data. But the caveat is that I'm not sure if you can do it as a "default" action or if you have to define it per every sourcetype separately.

[gcusello]

Hi @splunkreal ,

I'm sorry but it isn't possible.

It's possible to override index value before indexing only on not coocked events (not passed throgh an HF or IDX) using the method descibed at https://docs.splunk.com/Documentation/Splunk/9.2.2/Forwarding/Routeandfilterdatad#Route_inputs_to_sp...

Ciao.

Giuseppe