Hi Splunkers,
We have requirement to monitor wineventlogswith sourcename MSSQL and will be sent to different sets of IDX.
For global IDX, the wineventlogs inputs will be sourcename MSSQL only
For abc-region, the wineventlogs inputs will be sourcename MSSQL and ComputerName with ending in "abc.com" domain (e.g. XXXXX.abc.com, YYYY.abc.com).
With this, is the configurations below correct? Looking forward to your insights.
##########################################
inputs.conf
#####################################
[WinEventLog://Application]
index=mssql_idx
whitelist= SourceName=%MSSQL%
sourcetype=mssql:app
disabled=false
_TCP_ROUTING=idx-all-global
crcSalt=<SOURCE>
[WinEventLog://Application]
index=mssql_idx
whitelist= SourceName=%MSSQL% ComputerName=%abc.com%
sourcetype=mssql:app
disabled=false
_TCP_ROUTING=idx-abc-region
crcSalt=<SOURCE>
##########################################
outputs.conf
##########################################
[indexAndForward]
index=false
[tcpout]
defaultGroup= idx-all-global, idx-abc-region
[tcpout:idx-all-global]
server=global-idx1:9997, global-idx2:9997
[tcpout:idx-abc-region]
server= abc-region-idx1:9997, abc-region-idx2:9997
