How to segment syslog events by indexer? - Splunk Community

Getting Data In

Hi everyone,

I am trying to configure one way to segment syslog events by user.

Example:
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP01|...
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP02|...
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP03|...

I would like to send all syslog with:
SERVERGROUPNAME=SRVGP01 to indexer X
SERVERGROUPNAME=SRVGP02 to indexer Y
SERVERGROUPNAME=SRVGP03 to indexer Z

How can I do that?

Thanks!
Vitor Pedralli

Have a look at this:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Filter_and_route_ev...

This links gives you a sample configuration for routing event to different indexer (as defined in tcpout group in outputs.conf) based on keywords in the event's raw data.

Please note this needs to be setup on the first Splunk Enterprise instance in your data flow (if using Heavy Fwd, setup on those Or to be set on indexers).

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...