In my environment I have a setup of two heavy forwarders forwarding to a set of clustered indexers.
I want those forwarders to receive syslog, and depending on the facility/severity the incoming data should be forwarded to different indexes.
To get the syslog facility/severity, I want to do a lookup for the priority I receive in the event. To do that lookup, I figured I need a named field for the priority.
So I created an app for those forwarders with the following:
[generic_syslog] EXTRACT-extract_syslog_priority = ^<(?<syslog_priority>\d+)> LOOKUP-lookup_syslog_priority = syslog_priority_lookup syslog_priority OUTPUTNEW syslog_facility, syslog_severity
[syslog_priority_lookup] filename = syslog_priorities.csv
However, above config does not seem to work. The indexed events have no fields as "syslogpriority", nor "syslogfacility" or the severity.
What am I getting wrong here?
Sorry, won't work 😞
Lookups and field extractions using
EXTRACT are a search time function, and cannot be made to "fire" during index time pipeline processing. You'll need to come up with another way of accomplishing index-time routing - probably based on regex alone.
Well, that does indeed explain what I am getting wrong :). Thank you!
I took that idea off of this app: https://splunkbase.splunk.com/app/736/
Am I correct on the assumption this would work again, if it wasn't for my 6.4.1 heavy forwarder, but 6.3 or older?
Sadly, I am left alone in the field with (so far) zero experience in configuring Splunk.
I don't think I fully understand what possibilities I have to achieve that, and where/how to configure those. Could you provide me with a possible way, or just a keyword that I can go dig into?
Maybe a similar example, on which I can go full copycat again?