Setting the index in props.conf

[las]

I have a configuration with a log root with several log files, most of these are harmless, but one file contains confidential information.

logroot\loga.log
logroot\logb.log  
logroot\secure.log  

my inputs.conf monitors logroot.

I then use props.conf to set the sourcetype, but I would like to be able to route the secure.log to a different index.

Do I have to use a transform, and use ressources on my indexer, or could I specify this in either props og inputs.conf and do the selection on the universalForwarder?

[las]

The files in the directory has different sourcetypes, so I need to set it on a per file basis.

[yannK · Accepted solution]

An easier alternative is to define a special inputs on your specific file that will setup the destination index.
A stanza that has an exact path will have precedence over one with a wilcard.

[monitor://logroot\*.log]
sourcetype=mygenericsourcetype
index=mygenericindex

[monitor://logroot\secure.log]
sourcetype=myspecificsourcetype
index=myspecificindex

[triest]

Just FYI the generic with a blacklist and then a more specific monitor does not work in Splunk 6. Support has said it was never officially supported but the rules were a bit lose and have been tightened in 6.

[las]

Thanks, I will play around with this solution.

[bmacias84]

I would add a blacklist your generic monitor.

[monitor://logroot\*.log]

sourcetype=mygenericsourcetype

blacklist = secure.log$

index=mygenericindex

\

[monitor://logroot\secure.log]

sourcetype=myspecificsourcetype

index=myspecificindex

[yannK]

2 remarks :

• The Universal Forwarder cannot parse events. Any filtering has to happend at index time, therefore it has to be setup on the indexers or on a heavy forwarder.
• if you already use a filter to change the sourcetype, you can add a new transforms to change the meta fiel "index" You will need : props.conf, transforms.conf see http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Setupmultipleindexes#Route_specific_events_t...

[las]

Yes, that is why, I wondered if it was possible to do it earlier in the process, as it is not a per event filtering, but a per file.

[Ayn]

Why are you using props.conf to set sourcetype? The easiest is to do this directly in inputs.conf. Same goes for index.