Getting Data In

routing problem

Path Finder

I have a FW server and the indexer server, the FW server use UDP 514 to receive all logs send from the remote devices, and the indexer server use tcp 9997 to receive all logs forward from the FW server, in the FW server and indexer server side, my props.conf are the same like that:

index = ironport_index

index = test_index1

index = test_index2

index = cisco_asa_

TRANSFORMS-routing = to_test_index3

And the transforms.conf like that:

REGEX = ^\S+\s+\d+\s+\d+:\d+:\d+\s+192\.168\.2\.*
DEST_KEY = _MetaData:Index
FORMAT = test_index3

But it seems all logs don't go to the specify indexes, all go to the main index, I don't know why, do you have any idea? thanks.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

While it may seem counterintuitive, index = foo in props.conf has no meaning. The code won't do anything on that basis.

In order to get the index to be set based on the host key in your data, there must be a TRANSFORMS key pointing to a transform stanza.

At the input layer, controlled by inputs.conf, you can pre-set the target index for all data that input stanza receives, which is where you may have picked up this pattern.

In this type of arrangement, I think you want to use the same TRANSFORMS-routing key for all four stanzas, set to different values, so that the stanza layering system simply selects a different transform for each data category. Eg.

TRANSFORMS-routing = to_ironport_index

TRNAFORMS-routing = to_test_index1

TRANSFORMS-routing = to_test_index2

TRANSFORMS-routing = to_cisco_asa_index

TRANSFORMS-routing = to_test_index3

With transforms.conf entries for each that probably look something like:

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!