Getting Data In

Need help with redirecting index...

moshman
Explorer

Currently our Sun systems dump all of their authentication logs to the syslog sourcetype.

I want to pull those "auth" entries out of there and put them into a different index I have setup called unix_secure

I have the following files in /opt/splunk/etc/system/local on one of my forwarder systems but it is not working.

Any thoughts?

props.conf

[syslog]

TRANSFORMS-index = AuthRedirect

transforms.conf

[AuthRedirect]

REGEX = auth.

DEST_KEY = _MetaData:Index

FORMAT = unix_secure

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

This configuration needs to be put into place where the data is parsed, which usually means you'd use it on an indexer. In the case of a forwarder, it will only work on a heavy forwarder. On a LWF/UF, this wouldn't work at all, as almost nothing is parsed on these instances.

View solution in original post

moshman
Explorer

Thanks jbsplunk - worked like a charm!

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

Glad to help! If you found this useful, please feel free to accept and upvote the answer.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

This configuration needs to be put into place where the data is parsed, which usually means you'd use it on an indexer. In the case of a forwarder, it will only work on a heavy forwarder. On a LWF/UF, this wouldn't work at all, as almost nothing is parsed on these instances.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...