Forward logs from Splunk A to Splunk B, restricted to hosts within a specific index.

[quangtran]

I have a Splunk server (Splunk A) with indexes named var_log_***, which contain logs from both UAT and Prod hosts. I’d like to forward only the logs from UAT hosts to another Splunk instance (Splunk B). The condition is that the host field contains 'UAT'. Is there a way to achieve this? Thanks!

[PrewinThomas]

@quangtran 

Yes you can route the data using props.conf and transforms.conf on Splunk A to selectively route events based on the host field. You can achieve this by filtering host/sourcetype/source ...

For eg:

props.conf

[var_log_*]
TRANSFORMS-routing = route_UAT

transforms.conf

[route_UAT]
REGEX = UAT
SOURCE_KEY = MetaData:Host
DEST_KEY = _TCP_ROUTING
FORMAT = uat_indexer

outputs.conf

[tcpout]
defaultGroup = default-autolb-group

[tcpout:uat_indexer]
server = splunkB_IP:9997

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[quangtran]

Thank you for your reply, it was really helpful. The solution works for forwarding logs from Splunk A to Splunk B, but it doesn’t seem to filter out non-UAT logs. In my var_log_*** indexes on Splunk B, I still see hosts that are not UAT.
UAT hosts follow a naming pattern like uat-xyz-xyza.

I have already placed the props.conf and transforms.conf configuration files into Splunk\etc\system\local.

[PrewinThomas]

@quangtran 
Modify your transofms.conf

[route_UAT]
REGEX = ^uat-.*
SOURCE_KEY = MetaData:Host
DEST_KEY = _TCP_ROUTING
FORMAT = uat_indexer