Getting Data In

How to segment syslog events by indexer?

vitorpedralli
Engager

Hi everyone,

I am trying to configure one way to segment syslog events by user.

Example:
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP01|...
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP02|...
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP03|...

I would like to send all syslog with:
SERVERGROUPNAME=SRVGP01 to indexer X
SERVERGROUPNAME=SRVGP02 to indexer Y
SERVERGROUPNAME=SRVGP03 to indexer Z

How can I do that?

Thanks!
Vitor Pedralli

0 Karma

somesoni2
Revered Legend

Have a look at this:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Filter_and_route_ev...

This links gives you a sample configuration for routing event to different indexer (as defined in tcpout group in outputs.conf) based on keywords in the event's raw data.

Please note this needs to be setup on the first Splunk Enterprise instance in your data flow (if using Heavy Fwd, setup on those Or to be set on indexers).

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.