Getting Data In
Highlighted

route data to custom index using source

Path Finder

i have three different source
1. /var/log/auth.log
2. /var/log/syslog

i want data to route my custom index

source 1 and source 2 to INDEXA

can any one help me??

i tried this, but it didn't worked

props.conf

[/var/log/auth.log]
TRANSFORMS-routingforvarlogauthsource = routeto_indexa

[/var/log/syslog]
TRANSFORMS-routingforvarlogsyslogsource =routeto_indexb

transforms.conf

[routetoindexa]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = indexa

[routetoindexb]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = indexa

0 Karma
Highlighted

Re: route data to custom index using source

Super Champion

Destination indexes are typically specified in the inputs.conf
Can you post your inputs.conf entries for these sources?

0 Karma
Highlighted

Re: route data to custom index using source

Path Finder

As these sources are from network components, we don't have any control on inputs,

logging is enabled using the GUI of that particular Network component where we need to provide splunk Indexer Ip and port.

0 Karma
Highlighted

Re: route data to custom index using source

Super Champion

Regardless of whether you use the GUI or not, there is an inputs.conf file for these inputs (the GUI creates it).
If they are coming from different IPs or the same IP and different ports, then the index= parameter can be added to those inputs.conf stanzas.
If all sources are coming in on the same IP and port, then doing this in props/transforms is the way to go.

0 Karma
Highlighted

Re: route data to custom index using source

Path Finder

its is not splunk GUI,
it is GUI of that network component.

0 Karma
Highlighted

Re: route data to custom index using source

Super Champion

I did not know that Splunk could index data without an inputs.conf stanza for that data. I guess I'll have to study more. What is the network component manufacturer/model?

0 Karma
Highlighted

Re: route data to custom index using source

SplunkTrust
SplunkTrust

The props.conf stanza name for source (and host) should start with source:: (or host:: for host), like this.
props.conf

[source::/var/log/auth.log]
TRANSFORMS-routing_for_var_log_auth_source = route_to_indexa

[source::/var/log/syslog]
TRANSFORMS-routing_for_var_log_syslog_source =route_to_indexb

View solution in original post

0 Karma