How to segment syslog events by indexer?

[vitorpedralli]

Hi everyone,

I am trying to configure one way to segment syslog events by user.

Example:
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP01|...
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP02|...
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP03|...

I would like to send all syslog with:
SERVERGROUPNAME=SRVGP01 to indexer X
SERVERGROUPNAME=SRVGP02 to indexer Y
SERVERGROUPNAME=SRVGP03 to indexer Z

How can I do that?

Thanks!
Vitor Pedralli

[somesoni2]

Have a look at this:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Filter_and_route_ev...

This links gives you a sample configuration for routing event to different indexer (as defined in tcpout group in outputs.conf) based on keywords in the event's raw data.

Please note this needs to be setup on the first Splunk Enterprise instance in your data flow (if using Heavy Fwd, setup on those Or to be set on indexers).