Getting Data In

route data to custom index using source

saifuddin9122
Path Finder

i have three different source
1. /var/log/auth.log
2. /var/log/syslog

i want data to route my custom index

source 1 and source 2 to INDEXA

can any one help me??

i tried this, but it didn't worked

props.conf

[/var/log/auth.log]
TRANSFORMS-routing_for_var_log_auth_source = route_to_indexa

[/var/log/syslog]
TRANSFORMS-routing_for_var_log_syslog_source =route_to_indexb

transforms.conf

[route_to_indexa]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = indexa

[route_to_indexb]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = indexa

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The props.conf stanza name for source (and host) should start with source:: (or host:: for host), like this.
props.conf

[source::/var/log/auth.log]
TRANSFORMS-routing_for_var_log_auth_source = route_to_indexa

[source::/var/log/syslog]
TRANSFORMS-routing_for_var_log_syslog_source =route_to_indexb

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The props.conf stanza name for source (and host) should start with source:: (or host:: for host), like this.
props.conf

[source::/var/log/auth.log]
TRANSFORMS-routing_for_var_log_auth_source = route_to_indexa

[source::/var/log/syslog]
TRANSFORMS-routing_for_var_log_syslog_source =route_to_indexb
0 Karma

lukejadamec
Super Champion

Destination indexes are typically specified in the inputs.conf
Can you post your inputs.conf entries for these sources?

0 Karma

saifuddin9122
Path Finder

As these sources are from network components, we don't have any control on inputs,

logging is enabled using the GUI of that particular Network component where we need to provide splunk Indexer Ip and port.

0 Karma

lukejadamec
Super Champion

Regardless of whether you use the GUI or not, there is an inputs.conf file for these inputs (the GUI creates it).
If they are coming from different IPs or the same IP and different ports, then the index= parameter can be added to those inputs.conf stanzas.
If all sources are coming in on the same IP and port, then doing this in props/transforms is the way to go.

0 Karma

saifuddin9122
Path Finder

its is not splunk GUI,
it is GUI of that network component.

0 Karma

lukejadamec
Super Champion

I did not know that Splunk could index data without an inputs.conf stanza for that data. I guess I'll have to study more. What is the network component manufacturer/model?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...