How to split events in a syslog file to separate index

[wczimmerman]

I have a simple syslog server that collects data from many hosts and splunk is indexing the syslog logfile. I would like to separate data from a handful of hosts into a separate index at index time. What would be the best way to go about this?

[Ron_Naken]

It would be ideal to send the syslog data straight to Splunk, and setup a separate port for the for the handful of hosts -- since you can specify an Index when defining the data input.

Otherwise, you could use a RegEx to identify the data you want to move, like this:

PROPS.CONF:
[source::...mysyslogfile...]
TRANSFORMS-movestuff = xf_index

TRANSFORMS.CONF:
[xf_index]
REGEX = matchthis
DEST_KEY = _MetaData:Index
FORMAT = thisindex

Use FORMAT to specify the index name. Don't forget to create your index, first.