How would you use Transform.conf to filter an index into a sub-index?

[DontStopNowBaby]

Hi.

Apologies if it's been asked before but is there some guide on how to use the props.conf or transform.conf to filter events in an index into smaller index?

My use case is :

• I have an Antivirus that forwards the log data into a syslog file on my SPLUNK Intermediate Forwarder.

• SPLUNK monitors that file and stores that data into an "All_Customer.index" that contains the logs for all my clients.

• Now, i am trying to segregate the data into "client_A.index" and "client_B.index", and this is where i'm stuck with no head nor tail on how to achieve this.

• What i have are the IP addresses which client_A is using 10.100.1.x/24 and client _B is using 10.100.2.x/24.

I would appreciate it if you could guide me on how to achieve this end result.

[gcusello]

Hi DontStopNowBaby,
see this https://docs.splunk.com/Documentation/Splunk/7.2.0/Data/Advancedsourcetypeoverrides for indedes iit's the same thing.

Try something like this:

props.conf

[your_sourcetype]
TRANSFORMS-index = route_to_index_A,route_to_index_B

transforms.conf

[route_to_index_A]
SOURCE_KEY = _raw
REGEX = <regex to identify IP A>
DEST_KEY = _MetaData:Index
FORMAT = client_A_index
[route_to_index_B]
SOURCE_KEY = _raw
REGEX = <regex to identify IP B>
DEST_KEY = _MetaData:Index
FORMAT = client_B_index

Bye.
Giuseppe