Getting Data In

Replicate a subset of data to a third-party system for specific index

evinasco
Communicator

Hi team

i need to foward a copy data from specific index to third-party system, someone knows how i can do that

regards

Tags (1)
0 Karma

MuS
Legend

Hi evinasco,

Have a look at the docs here https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Replicate_a_subse...

Please note, that this setting is only configurable based on host, source or sourcetype but NOT on index.

Hope this helps ...

cheers, MuS

0 Karma

evinasco
Communicator

Hi @MuS, Do you know if this configuration shall do in the transforms.conf?

[routeAll]
REGEX=(.)
DEST_KEY=_TCP_ROUTING
FORMAT=Everything

[routeSubset]
REGEX=(sourcetype1|sourcetype2|sourcetype3)
DEST_KEY=_TCP_ROUTING
FORMAT=Subsidiary,Everything

regadrs

0 Karma

MuS
Legend

Actually something like this would make more sense:

props.conf

[sourcetype1]
TRANSFORMS-001-Send-Subsidiary-sourcetype1 = Send-Subsidiary-sourcetype

[sourcetype2]
TRANSFORMS-002-Send-Subsidiary-sourcetype2 = Send-Subsidiary-sourcetype

[sourcetype1]
TRANSFORMS-003-Send-Subsidiary-sourcetype3 = Send-Subsidiary-sourcetype

transforms.conf

[Send-Subsidiary-sourcetype]
DEST_KEY = _TCP_ROUTING
FORMAT = Subsidiary, Everything

The reason for that is if you send everything by default to one destination, there is no need to configure a transforms stanza for this and add additional parsing load for these events 😉

Hope that makes sense ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...