I have a log that contains different customer IDs. I want to be able to split different events from the same log into different Splunk indexes depending on the customer ID.
The customer IDs are fairly static. Hence right now I'm thinking of placing customer IDs in a lookup and using this to route events. Is this possible?
Can anyone give any advice on how they have (or would) approach and execute something like this.
Use props.conf and transforms.conf for this..
#props.conf [source] TRANSFORMS-routing_for_norris_index = route_to_norris_index #transforms.conf [route_to_norris_index] DEST_KEY = _MetaData:Index REGEX = chuck FORMAT = norris
This will route all events containing
chuck into the
The remaining events that do not match the regex
chuck will go into their configured index in inputs.conf (best practice) or into the configured default index of your Splunk (not best practice).
Hope this helps ...