Getting Data In

How to route data from forwarders to separate indexes based on the source field when data is coming from single TCP port?

bkumarm
Contributor

I have log data from multiple sources coming into a single TCP port in JSON format as below:

<01>- hostname {"name":"DefaultProfile","version":"1.0","isonjkpFormat":"yyyy-MM-dd'T'HH:mm:ss.SSSZ","type":"Event","category":"RT_FLOW_SESSION_CREATE_LS" [helps@2222.2.2.2.2.22 localis-compute-zxcv=\"ABC1\" application=\"UNKNOWN\" MKUNJI-application=\"UNKNOWN\" mnbhyujgt=\"UNKNOWN\"]","bgasbnJuh":"1","mnbIPOUN":"other","absIPPOL":"other","qweTgvfrt":"minj-bag6-7856ab-Hnqasui","abcPecpokk":"och-00-145-987.Net_11_4_5_6","mnbJhbpoiu":"other","source":"My application1","nhjRkyhcfBhytf":"MKI-PLO-ASW","thuHyrtfcQhbnjuytfv":"192.168.1.11"}

From this input, I want to forward the data to separate indexes based on the values for the source field.

Example: if source: application1, then send to index1, and so on.
Does the Splunk forwarder have this capability to extract a field and segregate the events to separate indexes on the indexer?

0 Karma

javiergn
Super Champion

Short answer
Universal Forwards can't inspect data. Heavy Forwarders (and Indexers) can.

Long answer
Use regex to parse the values of your JSON events and then redirect (override) accordingly to the right index.
See this:

https://answers.splunk.com/answers/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-na...
https://answers.splunk.com/answers/246672/how-can-i-override-an-index-name-based-on-sourcety.html
http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...