Getting Data In

indexRouting with customFilters to route based on log content

New Member

I would like to use indexRouting to move some log lines to a given index and have other log lines go to athe HEC's default index.  The log lines that I want to route are single-line json formatted as a HEC event.  Below is a pretty-printed example:


      "description":"Publishing to web socket",



Other log lines are normal text logs (non-json formatted):


2021-08-27 19:09:14,295 INFO [tornado.access] 202 POST /1/analytics/log ( 35.62ms



I see that there is a customFilter feature.  I am hoping that Ican  key off of the 'index' field in the HEC event to route these json log lines to their index and allow all other lines to go to the default index for the HEC.

Is that possible?  Is there some documentation that would help me?  Thanks.

Labels (3)
0 Karma

Ultra Champion

You can use a transform to rewrite the index metadata field of an event.

So in a props.conf you do


And in transforms.conf (assuming you want to redirect json events:

REGEX = {.*}
FORMAT = index2
DEST_KEY = _MetaData:Index


EDIT: I'm not sure if {} don't need to be escaped in regex.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...