Getting Data In

Routing to index from Heavy Forwarder

knutsod
Path Finder

I have windows logs from a universal forwarder being sent to my heavy forwarder where I using props.conf and transforms.conf to only allow specific event id through. Now I am trying to make the events go to a specific index on my indexer. In my transforms.conf stanza that filters the events I had:

[security]
REGEX = (?m)EventCodes=(listOfEventCodes)
DEST_KEY = queue
FORMAT = indexQueue

I changed this to look like this:

[security]
REGEX = (?m)EventCodes=(listOfEventCodes)
DEST_KEY = _MetatData:Index
FORMAT = securityindex

I expected to see the new events in the securityindex on my indexer, what I found was the my event where not even coming to my indexer anymore. I assume that the data pipe was trying to index the events locally on the heavyforwarder and not sending them to the indexer.

So my question is, is there a way to define what index an event should go to on the indexer from the heavy forwarder configs?

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi knutsod,

see the docs about route and filter data for some nice examples. Remember to enable forwarding on the heavy forwarder, else it will not send the event to the final indexer. Last but not least, don't forget to create the index on the receiving indexer.

cheers, MuS

View solution in original post

0 Karma

lguinn2
Legend

DEST_KEY = _MetatData:Index

has a typo. It should be

DEST_KEY = _MetaData:Index

0 Karma

MuS
Legend

Hi knutsod,

see the docs about route and filter data for some nice examples. Remember to enable forwarding on the heavy forwarder, else it will not send the event to the final indexer. Last but not least, don't forget to create the index on the receiving indexer.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...