route data to custom index using source

[saifuddin9122]

i have three different source
1. /var/log/auth.log
2. /var/log/syslog

i want data to route my custom index

source 1 and source 2 to INDEXA

can any one help me??

i tried this, but it didn't worked

props.conf

[/var/log/auth.log]
TRANSFORMS-routing_for_var_log_auth_source = route_to_indexa

[/var/log/syslog]
TRANSFORMS-routing_for_var_log_syslog_source =route_to_indexb

transforms.conf

[route_to_indexa]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = indexa

[route_to_indexb]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = indexa

[somesoni2 · Accepted solution]

The props.conf stanza name for source (and host) should start with source:: (or host:: for host), like this.
props.conf

[source::/var/log/auth.log]
TRANSFORMS-routing_for_var_log_auth_source = route_to_indexa

[source::/var/log/syslog]
TRANSFORMS-routing_for_var_log_syslog_source =route_to_indexb

[lukejadamec]

Destination indexes are typically specified in the inputs.conf
Can you post your inputs.conf entries for these sources?

[saifuddin9122]

As these sources are from network components, we don't have any control on inputs,

logging is enabled using the GUI of that particular Network component where we need to provide splunk Indexer Ip and port.

[lukejadamec]

Regardless of whether you use the GUI or not, there is an inputs.conf file for these inputs (the GUI creates it).
If they are coming from different IPs or the same IP and different ports, then the index= parameter can be added to those inputs.conf stanzas.
If all sources are coming in on the same IP and port, then doing this in props/transforms is the way to go.

[saifuddin9122]

its is not splunk GUI,
it is GUI of that network component.

[lukejadamec]

I did not know that Splunk could index data without an inputs.conf stanza for that data. I guess I'll have to study more. What is the network component manufacturer/model?