Getting Data In

TCP routing and change target index on secondary Splunk platform

splunkreal
Motivator

Hello,

We have two clustered Splunk platforms.

Several sources are sent to both platforms (directly to clustered indexers) as index app-idx1, then on 2nd platform we use different target index name using props.conf/transforms.conf to have application_idx2

For unknown reason few sources are failing to lastchanceindex.

 

props.conf

[source::/path/to/app_json.log]

TRANSFORMS-app-idx1 = set_idx1_index

 

transforms.conf

[set_idx1_index]

SOURCE_KEY = _MetaData:Index

REGEX = app-idx1

DEST_KEY = _MetaData:Index

FORMAT = application_idx2

 

Thanks for your help.

 

 

* If this helps, please upvote or accept solution if it solved *
0 Karma

sainag_splunk
Splunk Employee
Splunk Employee

To troubleshoot your sources failing to lastchanceindex, I recommend checking if your REGEX pattern is too strict.






If this helps, Please Upvote.

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...