Getting Data In

route data to different index based on two fields

kittu26
New Member

For the below data, I want to route indexes based on two fields : EventType and Department. All departments have separate indexes for TRACE events and non-TRACE events.

When EventType is TRACE and department is Department1
Then event should go to index Department1_TRACE

All non-TRACE event types (WARN,ERROR) should go to respective Department Index.
Like, WARN/ERROR event for Department2 should go to Index Department2.

Please help me with configuration files.

<?xml version="1.0" encoding="UTF-8"?>
<addresses>
  <address>
  <LogTime>02/22/2014 07:15:49 AM</LogTime>
<EventType>TRACE</EventType>
<Department>Department1</Department>
    <name>Joe Tester</name>
    <street>Baker street 5</street>
  </address>
   <address>
  <LogTime>02/22/2014 08:15:49 AM</LogTime>
<EventType>Error</EventType>
<Department>Department2</Department>
    <name>Joe Tester</name>
    <street>Baker street 5</street>
       </address> 
   <address>
  <LogTime>02/22/2014 09:15:49 AM</LogTime>
<EventType>WARN</EventType>
<Department>Department3</Department>
    <name>Joe Tester</name>
    <street>Baker street 5</street>
      </address>
</addresses>

Thanks!

0 Karma

DavidHourani
Super Champion

Check this out http://answers.splunk.com/answers/133299/route-data-to-indexes-based-on-fields it might be close to what you are looking for 😄

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...