Getting Data In

How to specify an index for storing data from forwarders

nickcode
Explorer

How to specify different indexes for storing data of different source(sourcetype)? The data is coming from remote forwarders.

0 Karma
1 Solution

Ayn
Legend

Define an index-time transform on the indexer and have it apply to the appropriate events.

For example:

props.conf:

[myfavoritesourcetype]
TRANSFORMS-index=sendtomyindex

transforms.conf:

[sendtomyindex]
REGEX=.
DEST_KEY=_MetaData:Index
FORMAT=myindex
WRITE_META=true

View solution in original post

Ayn
Legend

Define an index-time transform on the indexer and have it apply to the appropriate events.

For example:

props.conf:

[myfavoritesourcetype]
TRANSFORMS-index=sendtomyindex

transforms.conf:

[sendtomyindex]
REGEX=.
DEST_KEY=_MetaData:Index
FORMAT=myindex
WRITE_META=true

Ayn
Legend

See martin's answer for more info on that.

0 Karma

nickcode
Explorer

Thank you, I'll try it. By the way, how to get it right from the start on the forwarders as you refered above.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

nickcode
Explorer

martin_mueller's solution may not be suitable for my requirement. Then, how to use transforms on the indexer or config the forwarders, Ayn?

0 Karma

Ayn
Legend

...on the remote forwarders that is.

If you can't affect how things are setup on these forwarders, you can also rewrite which index events are stored in by using transforms on the indexer. But really, the best thing is to get it right from the start on the forwarders instead.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...