UDP syslog seprate index for specific hosts

[satishp]

Hey Guys,

I have multiple host in my network using UDP:514 syslog to main index in splunk but now i want to create separate "production" index for critical server. so how should i divert syslog traffic to new index ? I read on google people talking about props.conf but how it will work ?

[briang67]

I've got something similar working where I'm sending specific type syslog msg to a separate index. In my case I'm specifying [syslog] in my props.conf and then doing a regex match for the msg I want in the transforms.conf.

If you're only sending syslog msgs from the host you want, you can probably filter on the host itself to send all msgs to the separate index. Something like the below (I haven't tested this btw)

props.conf

[host::somehost]

TRANSFORMS-syslog-somehost=SYSLOGSOMEHOST

transforms.conf

[SYSLOGSOMEHOST]

REGEX =(.*)

DEST_KEY = _MetaData:Index

FORMAT = YOURINDEX

WRITE_META = true