How to send data to different index?

[sarit_s]

Hello

I have some kind of data that I want to filter to different index and in the future i would like to stop this index entirely.

The data I want to filter is 

1. all the logs with debug mode

2. logs that contains  Categories!="" OR Categories!=$* OR Categories!="* *" 

How it can be done ?

Thanks

[gcusello]

Hi @sarit_s,

at first the rules to have different indexes are two:

• different retention times,
• different access grants.

In your case I suppose that debug logs have a lower retention than the others.

Anyway, you can address logs to an index in inputs.conf, indicating the destination index in each stanza.

Otherwise, you can override the index value following the instructions that you can find in many answers.

In few words:

you have at first to identify the sourcetype and a regex to select the events to send in a different index, then you have to put

in props.conf

[your_sourcetype]
TRANSFORMS-index = overrideindex

and on transforms.conf

[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = <your_regex>
FORMAT = your_new_index

Rememeber that these two conf files must be in the first full Splunk instance you have (not Universal Forwarder), in other words in the first Heavy Forwarder (if present) or on Indexers.

Ciao.

Giuseppe