Populating Syslog Data from Cisco WLC into a Specific Index

[fdharmawan]

Hi Guys,

May I know how to make syslog data from a specific IP (in this case Cisco WLC) to be inserted into a specific index? I already forwarded the syslog into Splunk, but somehow it falls into the wrong index. From the WLC side, unfortunately it cannot specify the syslog port. I did created the index and forward the syslog from WLC to Splunk. But not sure how to connect the data into the index. Thank you.

[gcusello]

Hi @fdharmawan,
you have to insert in your Indexers and (if present) Heavy Forwarders, the following files:

In $SPLUNK_HOME/etc/system/local/transforms.conf

[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = .
FORMAT = my_new_index

In $SPLUNK_HOME/etc/system/local/props.conf

[host::your_ip_address]
TRANSFORMS-index = overrideindex

In addition I hint, you could create a dedicated app and insert these props.conf and transforms.conf in it: $SPLUNK_HOME/etc/apps/your_app/local

Ciao.
Giuseppe