Getting Data In
Highlighted

How to route events from a single host to multiple indexes?

Communicator

Hi Splunk Community,

I've the following scenario where I would like to route the events (JSON format) coming from a hostA to indexes A, B, and C. If the field value or string testA appears in the events, route to indexA, then if testB appears, route to indexB, and so on using props.conf and transforms.conf files in the Indexer.

Thanks for the help!

0 Karma
Highlighted

Re: How to route events from a single host to multiple indexes?

Motivator

Hello @Yaichael
I believe this should work.

props.conf

[host::HOSTA]
TRANSFORMS-route_events_hosta = route_events_to_indexA

[host::HOSTB]
TRANSFORMS-route_events_hostb = route_events_to_indexB

transforms.conf

[route_events_to_indexA]
REGEX = <regex to match textA>
FORMAT = indexA
DEST_KEY = _MetaData:Index

[route_events_to_indexB]
REGEX = <regex to match textB>
FORMAT = indexB
DEST_KEY = _MetaData:Index

Hope it helps.

View solution in original post

Highlighted

Re: How to route events from a single host to multiple indexes?

Communicator

Hi alemarzu,

Thanks that helps, but in my case, it would be from a single host (hostA), but I get the idea.

I guess my issue is the regex to match the testA; it seems that putting testA, as it is, in REGEX doesn't do the trick.

Thanks!

0 Karma
Highlighted

Re: How to route events from a single host to multiple indexes?

Motivator

I can help you with the regular expression if you can share the string to match.

0 Karma
Highlighted

Re: How to route events from a single host to multiple indexes?

Communicator

Here's the sample of the string to match.

{"quarantined" : false,"targetPriorityType" : "MEDIUM","deviceOwnerId" : 72622,"deviceGuid" : null,"email" : "test@test.net",
"deviceSessionId" : null,"assignedToId" : null,"assignedToName" : null,"deviceType" : "WINDOWS","activationCode" : "CODE","firstName" : null,
"lastName" : null,"middleName" : null,"createTime" : null,"lastReportedTime" : 1502916617373,"deviceId" : 235183,"organizationId" : 000,
"lastVirusActivityTime" : 0,"firstVirusActivityTime" : 0,"osVersion" : "Windows 10 x64","activationCodeExpiryTime" : 1496944516188,
"organizationName" : "COMPANY","sensorVersion" : "X.X.X.X","registeredTime" : 1496339794497,"lastContact" : 1502917965783,
"windowsPlatform" : null,"vdiBaseDevice" : null,"avStatus" : [ "AV_ACTIVE","ONDEMAND_SCAN_DISABLED" ],"deregisteredTime" : null,
"sensorStates" : [ "ACTIVE","SECURITY_CENTER_OPTLN_DISABLED" ],"messages" : null,"rootedBySensor" : false,"rootedBySensorTime" : null,
"lastInternalIpAddress" : "192.168.X.X","lastExternalIpAddress" : "X.X.X.X","lastLocation" : "OFFSITE","sensorOutOfDate" : false,
"avUpdateServers" : null,"passiveMode" : false,"lastResetTime" : 0,"lastShutdownTime" : 1497873764155,"scanStatus" : null,
"scanLastActionTime" : 0,"scanLastCompleteTime" : 0,"linuxKernelVersion" : null,
"avEngine" : "X.X.X.X-ave.X.X.X.X:avpack.X.X.X.X:vdf.X.X.X.X","avProductVersion" : "X.X.X.X","avAveVersion" : "X.X.X.X",
"avPackVersion" : "X.X.X.X","avVdfVersion" : "X.X.X.X","avLastScanTime" : 0,"rootedByAnalytics" : false,"rootedByAnalyticsTime" : null,
"testId" : -1,"avMaster" : false,"uninstalledTime" : null,"encodedActivationCode" : null,"name" : "TEST-PC","status" : "REGISTERED",
"policyName" : "TEST","policyId" : 8287}
0 Karma
Highlighted

Re: How to route events from a single host to multiple indexes?

Motivator

Ok then, try like this.

 REGEX = (?ms)\,\"name\"\s+:\s+\"TEST-PC\"\.\"status\"\s+:

This would match the event by the "name" value "TEST-PC"

Another example to match by "policyName" would be.

  REGEX = (?ms)\"policyName\"\s+:\s+\"TEST\"\,\"policyId\"
0 Karma
Highlighted

Re: How to route events from a single host to multiple indexes?

Communicator

Sorry for the late response, alemarzu.

The regex worked. Thanks for all your help!

0 Karma
Highlighted

Re: How to route events from a single host to multiple indexes?

Motivator

I'm glad it worked out for you. Happy Splunking!

0 Karma