Getting Data In
Highlighted

How would I change the index of a sourcetype?

New Member

For example using WinEventLog: Security
In props.conf

[WinEventLog:Security]
TRANSFORMS-routing=forexamplename

And in transforms.conf

[forexamplename]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = rabblerabbleforexample

Appreciate any help with this as well if I'm doing it wrong.

0 Karma
Highlighted

Re: How would I change the index of a sourcetype?

SplunkTrust
SplunkTrust

Recommended method would be to update your inputs.conf, on the forwarder(s) where you're collecting it, to include new index name.

inputs.conf on forwarder

[WinEventLog://Security]
index= rabblerabbleforexample
...other attributes...

If for some reason, you can't do that, above props-transforms would work (setup on Indexer or heavy forwarder whichever comes first in your data flow. would require a restart of Splunk)

Highlighted

Re: How would I change the index of a sourcetype?

Contributor

If your data is already ingested, you can use |collect

0 Karma