Getting Data In

How to send data to different index?

sarit_s
Communicator

Hello

I have some kind of data that I want to filter to different index and in the future i would like to stop this index entirely.

The data I want to filter is 

1. all the logs with debug mode

2. logs that contains  Categories!="" OR Categories!=$* OR Categories!="* *" 

How it can be done ?

Thanks

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sarit_s,

at first the rules to have different indexes are two:

  • different retention times,
  • different access grants.

In your case I suppose that debug logs have a lower retention than the others.

Anyway, you can address logs to an index in inputs.conf, indicating the destination index in each stanza.

Otherwise, you can override the index value following the instructions that you can find in many answers.

In few words:

you have at first to identify the sourcetype and a regex to select the events to send in a different index, then you have to put

in props.conf

[your_sourcetype]
TRANSFORMS-index = overrideindex

and on transforms.conf

[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = <your_regex>
FORMAT = your_new_index

Rememeber that these two conf files must be in the first full Splunk instance you have (not Universal Forwarder), in other words in the first Heavy Forwarder (if present) or on Indexers.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...