Routing to index based on host not working

[cmlombardo]

Hello there.

I have IIS logs being ingested into Splunk.

The sourcetype is currently set to "iis:test"

props.conf:

[iis:test]
TZ = UTC
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TRANSFORMS-8_AssignToIndex = setindex_dev, setindex_qa, setindex_stage, setindex_prod

transforms.conf:

[setindex_dev]
SOURCE_KEY = MetaData:Host
REGEX = (?i)^host::web-dev-2\d{1}.*$
DEST_KEY = _MetaData:Index
FORMAT = wf_dev_i

[setindex_qa]
SOURCE_KEY = MetaData:Host
REGEX = (?i)^host::web-qa-2\d{1}.*$
DEST_KEY = _MetaData:Index
FORMAT = wf_qa_i

[setindex_stage]
SOURCE_KEY = MetaData:Host
REGEX = (?i)^host::web-stg-2\d{1}.*$
DEST_KEY = _MetaData:Index
FORMAT = wf_stage_i

[setindex_prod]
SOURCE_KEY = MetaData:Host
REGEX = (?i)^host::web-2\d{1}.*$
DEST_KEY = _MetaData:Index
FORMAT = wf_prod_i

This should send the events coming from the host web-dev-20 to the wf_dev_i index. Instead, they go to the main index.

I have the same configuration set for other sources and it works fine.

What am I missing here?

Thank you,

Claudio

[gcusello]

Hi @cmlombardo,

where did you located this props and transforms files?

They must be located in the Indexers or, if present in the first Heavy Forwarder they are passing throgh, not on Universal Forwarder.

Ciao.

Giuseppe

[cmlombardo · Accepted solution]

Ciao Giuseppe,

props.conf and transforms.conf are on our HFs.

Since my post, I was able to finally find out what happened. The transforms names we chose were already used in other transformations elsewhere. What are the odds? Hilarious.

After checking so many times the syntax and the regexes I decided to take a look at all the transformations in place and found the culprit.

Now that the new transformations have a different name, everything works as expected.

Claudio

[gcusello]

Hi @cmlombardo,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @cmlombardo,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer (also your own) for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉