Getting Data In

How to split events from the same log into different indexes based on content?

Contributor

I have a log that contains different customer IDs. I want to be able to split different events from the same log into different Splunk indexes depending on the customer ID.

The customer IDs are fairly static. Hence right now I'm thinking of placing customer IDs in a lookup and using this to route events. Is this possible?

Can anyone give any advice on how they have (or would) approach and execute something like this.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi himynamesdave,

Use props.conf and transforms.conf for this..

 #props.conf
 [source]
 TRANSFORMS-routing_for_norris_index = route_to_norris_index

 #transforms.conf
 [route_to_norris_index]
 DEST_KEY = _MetaData:Index
 REGEX = chuck
 FORMAT = norris

This will route all events containing chuck into the norris index.

Cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi himynamesdave,

Use props.conf and transforms.conf for this..

 #props.conf
 [source]
 TRANSFORMS-routing_for_norris_index = route_to_norris_index

 #transforms.conf
 [route_to_norris_index]
 DEST_KEY = _MetaData:Index
 REGEX = chuck
 FORMAT = norris

This will route all events containing chuck into the norris index.

Cheers, MuS

View solution in original post

Loves-to-Learn Everything

what about remaining event in which index they will go?

0 Karma

SplunkTrust
SplunkTrust

The remaining events that do not match the regex chuck will go into their configured index in inputs.conf (best practice) or into the configured default index of your Splunk (not best practice).

Hope this helps ...

cheers, MuS

0 Karma

SplunkTrust
SplunkTrust

Do this on the Splunk server which is doing event parsing eq a heavy forwarder or indexer http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!