Security

How to direct certain sourcetypes into a non-default index

Alan_Bradley
Path Finder

When I've created a new index. how can I direct certain sourcetypes to be indexed in that new index, rather than into main?

Likewise, is it possible to have one or more sourcetypes indexed into multiple indexes simultaneously? The use case for this would be if you had two roles who were allowed to see only indexA and indexB, respectively, but there were some small amount of data that each needed to see in common.

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

It is easy to direct inputs to indexes by specifying an index clause where the input is defined. To direct by sourcetype, you must route using an index-time transform against MetaData:Sourcetype, and must furthermore make sure that your transform runs only after the sourcetype is set. In most cases, it's just as easy to set the index when you set the sourcetype anyway.

I would recommend you simply set up a third index for the overlap rather than trying to index data twice. There's not really a good way to do it, other than trickery involving forwarding the data to different ports on the same indexers or something along those lines.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

It is easy to direct inputs to indexes by specifying an index clause where the input is defined. To direct by sourcetype, you must route using an index-time transform against MetaData:Sourcetype, and must furthermore make sure that your transform runs only after the sourcetype is set. In most cases, it's just as easy to set the index when you set the sourcetype anyway.

I would recommend you simply set up a third index for the overlap rather than trying to index data twice. There's not really a good way to do it, other than trickery involving forwarding the data to different ports on the same indexers or something along those lines.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...