Solved: More than one DEST_KEY - Splunk Community

Getting Data In

Can I use more than one DEST_KEY? For example

DEST_KEY=_MetaData:Index,MetaData:Sourcetype
FORMAT=sourcetype::VPN,index::authent

I currently have some VPN logs coming in through syslog that I would like to route to an index, and rename the sourcetype.

1 Solution

Solution

This really should be two separate transforms.

Take a look at this thread:
http://answers.splunk.com/questions/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-n...

View solution in original post

Solution

This really should be two separate transforms.

Take a look at this thread:
http://answers.splunk.com/questions/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-n...

Get Updates on the Splunk Community!

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

GA: New Data Management App in Splunk Platform

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...