Moving cribl events to their own index

[dtamburin]

Brand new to splunk, inherited a slightly configured system.

I want to move certain cribl events to an index called vmware.

I added this...

props.conf

[sourcetype::cribl]
TRANSFORMS-index = route_to_vmware

transforms.conf

[route_to_vmware]
REGEX = (?i)vpxa
DEST_KEY = _MetaData:Index
FORMAT = vmware

Created an index in splunk.

Example of event, ending up in main index...

any help would be appreciated.  thank you

I did restart splunk from the GUI after changes were made.

[livehybrid]

Hi @dtamburin 

Cribl will be sending data which is already parsed, therefore the proposed props/transforms will not work, instead you can use Ingest Actions:

== props.conf ==
[cribl]
RULESET-ruleset_cribl = _rule:ruleset_cribl:set_index:eval:is31lica
RULESET_DESC-ruleset_cribl = 


== transforms.conf == 
[_rule:ruleset_cribl:set_index:eval:is31lica]
INGEST_EVAL = index=IF(match(_raw,"(?i)vpxa"),"vmware", index)

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[dtamburin]

thank you, I will try this also.

[richgalloway · Accepted solution]

Data from Cribl is "cooked" meaning it already has been processed so props and transforms on the indexers will not process it further.

You should change the index name in Cribl.