How to route events from a single host to multiple indexes?

[Yaichael]

Hi Splunk Community,

I've the following scenario where I would like to route the events (JSON format) coming from a hostA to indexes A, B, and C. If the field value or string testA appears in the events, route to indexA, then if testB appears, route to indexB, and so on using props.conf and transforms.conf files in the Indexer.

Thanks for the help!

[alemarzu · Accepted solution]

Hello @Yaichael
I believe this should work.

props.conf

[host::HOSTA]
TRANSFORMS-route_events_hosta = route_events_to_indexA

[host::HOSTB]
TRANSFORMS-route_events_hostb = route_events_to_indexB

transforms.conf

[route_events_to_indexA]
REGEX = <regex to match textA>
FORMAT = indexA
DEST_KEY = _MetaData:Index

[route_events_to_indexB]
REGEX = <regex to match textB>
FORMAT = indexB
DEST_KEY = _MetaData:Index

Hope it helps.

[Yaichael]

Here's the sample of the string to match.

{"quarantined" : false,"targetPriorityType" : "MEDIUM","deviceOwnerId" : 72622,"deviceGuid" : null,"email" : "test@test.net",
"deviceSessionId" : null,"assignedToId" : null,"assignedToName" : null,"deviceType" : "WINDOWS","activationCode" : "CODE","firstName" : null,
"lastName" : null,"middleName" : null,"createTime" : null,"lastReportedTime" : 1502916617373,"deviceId" : 235183,"organizationId" : 000,
"lastVirusActivityTime" : 0,"firstVirusActivityTime" : 0,"osVersion" : "Windows 10 x64","activationCodeExpiryTime" : 1496944516188,
"organizationName" : "COMPANY","sensorVersion" : "X.X.X.X","registeredTime" : 1496339794497,"lastContact" : 1502917965783,
"windowsPlatform" : null,"vdiBaseDevice" : null,"avStatus" : [ "AV_ACTIVE","ONDEMAND_SCAN_DISABLED" ],"deregisteredTime" : null,
"sensorStates" : [ "ACTIVE","SECURITY_CENTER_OPTLN_DISABLED" ],"messages" : null,"rootedBySensor" : false,"rootedBySensorTime" : null,
"lastInternalIpAddress" : "192.168.X.X","lastExternalIpAddress" : "X.X.X.X","lastLocation" : "OFFSITE","sensorOutOfDate" : false,
"avUpdateServers" : null,"passiveMode" : false,"lastResetTime" : 0,"lastShutdownTime" : 1497873764155,"scanStatus" : null,
"scanLastActionTime" : 0,"scanLastCompleteTime" : 0,"linuxKernelVersion" : null,
"avEngine" : "X.X.X.X-ave.X.X.X.X:avpack.X.X.X.X:vdf.X.X.X.X","avProductVersion" : "X.X.X.X","avAveVersion" : "X.X.X.X",
"avPackVersion" : "X.X.X.X","avVdfVersion" : "X.X.X.X","avLastScanTime" : 0,"rootedByAnalytics" : false,"rootedByAnalyticsTime" : null,
"testId" : -1,"avMaster" : false,"uninstalledTime" : null,"encodedActivationCode" : null,"name" : "TEST-PC","status" : "REGISTERED",
"policyName" : "TEST","policyId" : 8287}

[alemarzu]

Ok then, try like this.

 REGEX = (?ms)\,\"name\"\s+:\s+\"TEST-PC\"\.\"status\"\s+:

This would match the event by the "name" value "TEST-PC"

Another example to match by "policyName" would be.

  REGEX = (?ms)\"policyName\"\s+:\s+\"TEST\"\,\"policyId\"

[Yaichael]

Sorry for the late response, alemarzu.

The regex worked. Thanks for all your help!

[alemarzu]

I'm glad it worked out for you. Happy Splunking!

[Yaichael]

Hi alemarzu,

Thanks that helps, but in my case, it would be from a single host (hostA), but I get the idea.

I guess my issue is the regex to match the testA; it seems that putting testA, as it is, in REGEX doesn't do the trick.

Thanks!

[alemarzu]

I can help you with the regular expression if you can share the string to match.