Inputs.conf: How to route anything that comes in with the hostname of host=*vmware* to go to index=vmware?

[daniel333]

I have basic input for udp://514 with index=network setup as the default index.

We started taking syslog traffic from ESXi though. I'd like anything that comes in with the hostname of host=*vmware* to go to the index=vmware.

I am drawing a blank on this. Any help ?

[dolivasoh]

You'll need to configure this in the parsing phase. The indexer is essentially also a heavy forwarder so this applies here as well.

http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Routeandfilterdatad