I have a simple syslog server that collects data from many hosts and splunk is indexing the syslog logfile. I would like to separate data from a handful of hosts into a separate index at index time. What would be the best way to go about this?
It would be ideal to send the syslog data straight to Splunk, and setup a separate port for the for the handful of hosts -- since you can specify an Index when defining the data input.
Otherwise, you could use a RegEx to identify the data you want to move, like this:
TRANSFORMS-movestuff = xf_index
REGEX = matchthis
DEST_KEY = _MetaData:Index
FORMAT = thisindex
Use FORMAT to specify the index name. Don't forget to create your index, first.