Security

How to direct certain sourcetypes into a non-default index

Path Finder

When I've created a new index. how can I direct certain sourcetypes to be indexed in that new index, rather than into main?

Likewise, is it possible to have one or more sourcetypes indexed into multiple indexes simultaneously? The use case for this would be if you had two roles who were allowed to see only indexA and indexB, respectively, but there were some small amount of data that each needed to see in common.

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

It is easy to direct inputs to indexes by specifying an index clause where the input is defined. To direct by sourcetype, you must route using an index-time transform against MetaData:Sourcetype, and must furthermore make sure that your transform runs only after the sourcetype is set. In most cases, it's just as easy to set the index when you set the sourcetype anyway.

I would recommend you simply set up a third index for the overlap rather than trying to index data twice. There's not really a good way to do it, other than trickery involving forwarding the data to different ports on the same indexers or something along those lines.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

It is easy to direct inputs to indexes by specifying an index clause where the input is defined. To direct by sourcetype, you must route using an index-time transform against MetaData:Sourcetype, and must furthermore make sure that your transform runs only after the sourcetype is set. In most cases, it's just as easy to set the index when you set the sourcetype anyway.

I would recommend you simply set up a third index for the overlap rather than trying to index data twice. There's not really a good way to do it, other than trickery involving forwarding the data to different ports on the same indexers or something along those lines.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!