Getting Data In

How would I change the index of a sourcetype?

ronniebotts87
New Member

For example using WinEventLog: Security
In props.conf

[WinEventLog:Security]
TRANSFORMS-routing=forexamplename

And in transforms.conf

[forexamplename]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = rabblerabbleforexample

Appreciate any help with this as well if I'm doing it wrong.

0 Karma

somesoni2
Revered Legend

Recommended method would be to update your inputs.conf, on the forwarder(s) where you're collecting it, to include new index name.

inputs.conf on forwarder

[WinEventLog://Security]
index= rabblerabbleforexample
...other attributes...

If for some reason, you can't do that, above props-transforms would work (setup on Indexer or heavy forwarder whichever comes first in your data flow. would require a restart of Splunk)

valiquet
Contributor

If your data is already ingested, you can use |collect

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!