Syslog data going to lastchanceindex

[Dominic32]

I added a new syslog source using upd port 514. The data is being ingested into "lastchanceindex". How can I find out what index splunk "wants" to put the data into, so that I can create that index? Or how can I specify an index without disrupting the other syslog data sources?

We use udp://514 for many different syslog data sources, so specifying all of it to go to one index wouldn't work.

[Dominic32 · Accepted solution]

I was able to resolve the issue. in the _internal index, the following events were generated. I used this to determine which index Splunk wanted to sort the events into, and created it.

Search peer mysplunkidxs.splunkcloud.com has the following message: Redirected event for unconfigured/disabled/deleted index=intended_index with source="source::1234" host="host::abc" sourcetype="sourcetype::456:efg" into the LastChanceIndex. So far received events from 1 missing index(es).

[enzomialich]

IMO you should use a HF for this.

HF will route data based on its contents. So if a log comes with something "trend micro" send to a specific index.

It will be something like this: Solved: How do I route data to specific index based on a f... - Splunk Community

[Dominic32]

We are using 2 load balanced HFs for this.