Getting Data In

How would I change the index of a sourcetype?

New Member

For example using WinEventLog: Security
In props.conf


And in transforms.conf

DEST_KEY = _MetaData:Index
FORMAT = rabblerabbleforexample

Appreciate any help with this as well if I'm doing it wrong.

0 Karma

Revered Legend

Recommended method would be to update your inputs.conf, on the forwarder(s) where you're collecting it, to include new index name.

inputs.conf on forwarder

index= rabblerabbleforexample
...other attributes...

If for some reason, you can't do that, above props-transforms would work (setup on Indexer or heavy forwarder whichever comes first in your data flow. would require a restart of Splunk)


If your data is already ingested, you can use |collect

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!