Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to specify an index for storing data from forw...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to specify different indexes for storing data of different source(sourcetype)? The data is coming from remote forwarders.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Define an index-time transform on the indexer and have it apply to the appropriate events.
For example:
props.conf:
[myfavoritesourcetype]
TRANSFORMS-index=sendtomyindex
transforms.conf:
[sendtomyindex]
REGEX=.
DEST_KEY=_MetaData:Index
FORMAT=myindex
WRITE_META=true
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Define an index-time transform on the indexer and have it apply to the appropriate events.
For example:
props.conf:
[myfavoritesourcetype]
TRANSFORMS-index=sendtomyindex
transforms.conf:
[sendtomyindex]
REGEX=.
DEST_KEY=_MetaData:Index
FORMAT=myindex
WRITE_META=true
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
See martin's answer for more info on that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, I'll try it. By the way, how to get it right from the start on the forwarders as you refered above.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
By specifying a different index inside each monitor stanza in inputs.conf, see http://docs.splunk.com/Documentation/Splunk/latest/Data/Editinputs.conf#Configuration_settings and http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf for reference.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
martin_mueller's solution may not be suitable for my requirement. Then, how to use transforms on the indexer or config the forwarders, Ayn?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
...on the remote forwarders that is.
If you can't affect how things are setup on these forwarders, you can also rewrite which index events are stored in by using transforms on the indexer. But really, the best thing is to get it right from the start on the forwarders instead.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Make Your Machine Data AI-Ready in Splunk
Splunk Asynchronous Forwarding Explained
How to Monitor AI Agents with Splunk Agent Observability
