Getting Data In

Routing to index from Heavy Forwarder

knutsod
Path Finder

I have windows logs from a universal forwarder being sent to my heavy forwarder where I using props.conf and transforms.conf to only allow specific event id through. Now I am trying to make the events go to a specific index on my indexer. In my transforms.conf stanza that filters the events I had:

[security]
REGEX = (?m)EventCodes=(listOfEventCodes)
DEST_KEY = queue
FORMAT = indexQueue

I changed this to look like this:

[security]
REGEX = (?m)EventCodes=(listOfEventCodes)
DEST_KEY = _MetatData:Index
FORMAT = securityindex

I expected to see the new events in the securityindex on my indexer, what I found was the my event where not even coming to my indexer anymore. I assume that the data pipe was trying to index the events locally on the heavyforwarder and not sending them to the indexer.

So my question is, is there a way to define what index an event should go to on the indexer from the heavy forwarder configs?

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi knutsod,

see the docs about route and filter data for some nice examples. Remember to enable forwarding on the heavy forwarder, else it will not send the event to the final indexer. Last but not least, don't forget to create the index on the receiving indexer.

cheers, MuS

View solution in original post

0 Karma

lguinn2
Legend

DEST_KEY = _MetatData:Index

has a typo. It should be

DEST_KEY = _MetaData:Index

0 Karma

MuS
Legend

Hi knutsod,

see the docs about route and filter data for some nice examples. Remember to enable forwarding on the heavy forwarder, else it will not send the event to the final indexer. Last but not least, don't forget to create the index on the receiving indexer.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...