Getting Data In

multiple indexes in distrubuted splunk environment

ultra
Explorer

Before I ask my question, this is my environment.

1 forwarder

4 indexers

1 search head

I am trying to setup several indexes (based on source types).

I have created indexes on each of the indexers (ct_usertransaction), and setup rules according to the documentation.

props.conf (on forwarder)
[ct-UserTransaction]
TRANSFORMS-index = ct-UserTransaction


[ct-UserTransaction]
DEST_KEY = MetaData:Index
REGEX = (ct-UserTransaction:)
FORMAT = ct_usertransaction

But I don't see anything in ct_usertransaction index.

Where do I need to configure the rules, on a forwarder or indexers?

Tags (2)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

ultra
Explorer

Thank you very much for this. It is a helpful link.

But it raises another question.
How do I route specific events from a heavy weight forwarder to a specific index on a remote indexer?

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

You need to set this configuration on the indexer for lightweight forwarders and on the forwarder for heavyweight forwarders.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...