Getting Data In

Is it possible to route an overrided sourcetype to other index ?

Contributor

I have overrided some souretypes out of a huge syslog feed ( Kiwisyslog) Now I want to route specific sourcetypes to other indexes,,is this possible?

    props.conf

    [syslog]
    TRANSFORMS-sourcetype_and_host_override = asa_hostoverride, cisco_asa, cisco_fwsm
    SHOULD_LINEMERGE = false

    [cisco_firewall]
    TRANSFORMS-index = route_2_other_index


    transforms.conf

    [asa_hostoverride]
    DEST_KEY = MetaData:Host
    REGEX = \S+\t\S+\s(.*)\t+
    FORMAT = host::$1

    [cisco_asa]
    DEST_KEY = MetaData:Sourcetype
    REGEX = (%ASA)
    FORMAT = sourcetype::cisco_firewall

    [cisco_fwsm]
    DEST_KEY = MetaData:Sourcetype
    REGEX = (%FWSM)
    FORMAT = sourcetype::cisco_firewall

    [route_2_other_index]
    REGEX = (.)
    DEST_KEY = _MetaData:Index
    FORMAT other_index

Thanks!

Contributor

As Gkanapathy mentioned : I took the whole bunch onder the same master sourcetype : below for a single entry ( [cisco_asa_2_index] ) ,,,but this works for all my sourcetypes in syslog!

[syslog]

TRANSFORMS-sourcetype_and_host_override = asa_hostoverride, cisco_asa, cisco_fwsm, named, dhcp, cisco_asa_2_index
SHOULD_LINEMERGE = false


transforms.conf

[asa_hostoverride]
DEST_KEY = MetaData:Host
REGEX = \S+\t\S+\s(.*)\t+
FORMAT = host::$1

[cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = (%ASA)
FORMAT = sourcetype::cisco_firewall

[cisco_fwsm]
DEST_KEY = MetaData:Sourcetype
REGEX = (%FWSM)
FORMAT = sourcetype::cisco_firewall


[cisco_asa_2_index]
DEST_KEY = _MetaData:Index
REGEX = (%ASA)
FORMAT = other_index

Splunk Employee
Splunk Employee

Not the way you have done it. Transforms only happen in a single pass, so the [cisco_firewall] rule in props.conf will not apply, since the events have not had their sourcetype set to cisco_firewall yet. You would have to add another rule on [syslog] to match and set the index.

Contributor

so how do I add the cisco_firewall in other index?
Not sure what you mean though

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!