Solved: More than one DEST_KEY - Splunk Community

Getting Data In

Can I use more than one DEST_KEY? For example

DEST_KEY=_MetaData:Index,MetaData:Sourcetype
FORMAT=sourcetype::VPN,index::authent

I currently have some VPN logs coming in through syslog that I would like to route to an index, and rename the sourcetype.

1 Solution

Solution

This really should be two separate transforms.

Take a look at this thread:
http://answers.splunk.com/questions/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-n...

View solution in original post

Solution

This really should be two separate transforms.

Take a look at this thread:
http://answers.splunk.com/questions/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-n...

Get Updates on the Splunk Community!

Finding Based Detections General Availability

Overview We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars Sometimes, you just need to see the code. For those looking for a ...

What’s New in Splunk Observability Cloud: January Feature Highlights & Deep Dives

Splunk Observability Cloud continues to evolve, empowering engineering and operations teams with advanced ...