Getting Data In

How to route events from a single host to multiple indexes?

Communicator

Hi Splunk Community,

I've the following scenario where I would like to route the events (JSON format) coming from a hostA to indexes A, B, and C. If the field value or string testA appears in the events, route to indexA, then if testB appears, route to indexB, and so on using props.conf and transforms.conf files in the Indexer.

Thanks for the help!

0 Karma
1 Solution

Motivator

Hello @Yaichael
I believe this should work.

props.conf

[host::HOSTA]
TRANSFORMS-route_events_hosta = route_events_to_indexA

[host::HOSTB]
TRANSFORMS-route_events_hostb = route_events_to_indexB

transforms.conf

[route_events_to_indexA]
REGEX = <regex to match textA>
FORMAT = indexA
DEST_KEY = _MetaData:Index

[route_events_to_indexB]
REGEX = <regex to match textB>
FORMAT = indexB
DEST_KEY = _MetaData:Index

Hope it helps.

View solution in original post

Motivator

Hello @Yaichael
I believe this should work.

props.conf

[host::HOSTA]
TRANSFORMS-route_events_hosta = route_events_to_indexA

[host::HOSTB]
TRANSFORMS-route_events_hostb = route_events_to_indexB

transforms.conf

[route_events_to_indexA]
REGEX = <regex to match textA>
FORMAT = indexA
DEST_KEY = _MetaData:Index

[route_events_to_indexB]
REGEX = <regex to match textB>
FORMAT = indexB
DEST_KEY = _MetaData:Index

Hope it helps.

View solution in original post

Communicator

Here's the sample of the string to match.

{"quarantined" : false,"targetPriorityType" : "MEDIUM","deviceOwnerId" : 72622,"deviceGuid" : null,"email" : "test@test.net",
"deviceSessionId" : null,"assignedToId" : null,"assignedToName" : null,"deviceType" : "WINDOWS","activationCode" : "CODE","firstName" : null,
"lastName" : null,"middleName" : null,"createTime" : null,"lastReportedTime" : 1502916617373,"deviceId" : 235183,"organizationId" : 000,
"lastVirusActivityTime" : 0,"firstVirusActivityTime" : 0,"osVersion" : "Windows 10 x64","activationCodeExpiryTime" : 1496944516188,
"organizationName" : "COMPANY","sensorVersion" : "X.X.X.X","registeredTime" : 1496339794497,"lastContact" : 1502917965783,
"windowsPlatform" : null,"vdiBaseDevice" : null,"avStatus" : [ "AV_ACTIVE","ONDEMAND_SCAN_DISABLED" ],"deregisteredTime" : null,
"sensorStates" : [ "ACTIVE","SECURITY_CENTER_OPTLN_DISABLED" ],"messages" : null,"rootedBySensor" : false,"rootedBySensorTime" : null,
"lastInternalIpAddress" : "192.168.X.X","lastExternalIpAddress" : "X.X.X.X","lastLocation" : "OFFSITE","sensorOutOfDate" : false,
"avUpdateServers" : null,"passiveMode" : false,"lastResetTime" : 0,"lastShutdownTime" : 1497873764155,"scanStatus" : null,
"scanLastActionTime" : 0,"scanLastCompleteTime" : 0,"linuxKernelVersion" : null,
"avEngine" : "X.X.X.X-ave.X.X.X.X:avpack.X.X.X.X:vdf.X.X.X.X","avProductVersion" : "X.X.X.X","avAveVersion" : "X.X.X.X",
"avPackVersion" : "X.X.X.X","avVdfVersion" : "X.X.X.X","avLastScanTime" : 0,"rootedByAnalytics" : false,"rootedByAnalyticsTime" : null,
"testId" : -1,"avMaster" : false,"uninstalledTime" : null,"encodedActivationCode" : null,"name" : "TEST-PC","status" : "REGISTERED",
"policyName" : "TEST","policyId" : 8287}
0 Karma

Motivator

Ok then, try like this.

 REGEX = (?ms)\,\"name\"\s+:\s+\"TEST-PC\"\.\"status\"\s+:

This would match the event by the "name" value "TEST-PC"

Another example to match by "policyName" would be.

  REGEX = (?ms)\"policyName\"\s+:\s+\"TEST\"\,\"policyId\"
0 Karma

Communicator

Sorry for the late response, alemarzu.

The regex worked. Thanks for all your help!

0 Karma

Motivator

I'm glad it worked out for you. Happy Splunking!

0 Karma

Communicator

Hi alemarzu,

Thanks that helps, but in my case, it would be from a single host (hostA), but I get the idea.

I guess my issue is the regex to match the testA; it seems that putting testA, as it is, in REGEX doesn't do the trick.

Thanks!

0 Karma

Motivator

I can help you with the regular expression if you can share the string to match.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!