Getting Data In

multiple indexes in distrubuted splunk environment

Explorer

Before I ask my question, this is my environment.

1 forwarder

4 indexers

1 search head

I am trying to setup several indexes (based on source types).

I have created indexes on each of the indexers (ct_usertransaction), and setup rules according to the documentation.

props.conf (on forwarder)
[ct-UserTransaction]
TRANSFORMS-index = ct-UserTransaction


[ct-UserTransaction]
DEST_KEY = MetaData:Index
REGEX = (ct-UserTransaction:)
FORMAT = ct_usertransaction

But I don't see anything in ct_usertransaction index.

Where do I need to configure the rules, on a forwarder or indexers?

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Explorer

Thank you very much for this. It is a helpful link.

But it raises another question.
How do I route specific events from a heavy weight forwarder to a specific index on a remote indexer?

0 Karma

Splunk Employee
Splunk Employee

You need to set this configuration on the indexer for lightweight forwarders and on the forwarder for heavyweight forwarders.