Splunk Search

How to REGEX and ROUTE incoming syslog data to the correct index?

Log_wrangler
Builder

I have an HF listener receiving syslog data from multiple sources.

The source(s) events are going to the same index causing confusion.

So I plan to create another index, separate the events, and route to the appropriate index.

I believe this can be done with inputs and transforms, but I am not finding the correct documentation.

Please advise.

Thank you

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

I know this might not be the answer you are looking for but if I were you I would install a dedicated Syslog server instead of using Splunk directly.

Take a look at all the following answers/posts:

https://answers.splunk.com/answers/550151/best-practices-to-send-multiple-devices-to-a-singl.html
https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html
http://www.georgestarcher.com/splunk-success-with-syslog
https://www.function1.com/2012/05/syslog-collection-with-splunk

If you still want to go ahead with your approach (not recommended), then take a look at:

http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad

Thanks,
J

View solution in original post

0 Karma

javiergn
SplunkTrust
SplunkTrust

I know this might not be the answer you are looking for but if I were you I would install a dedicated Syslog server instead of using Splunk directly.

Take a look at all the following answers/posts:

https://answers.splunk.com/answers/550151/best-practices-to-send-multiple-devices-to-a-singl.html
https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html
http://www.georgestarcher.com/splunk-success-with-syslog
https://www.function1.com/2012/05/syslog-collection-with-splunk

If you still want to go ahead with your approach (not recommended), then take a look at:

http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad

Thanks,
J

0 Karma

Log_wrangler
Builder

Thank you for the reply.
At this point still trying to figure out what can and cannot be done. I will definitely consider what you are suggesting. After reading your links I do remember suggesting the syslog-ng and UF option on a different deployment but in this case it would be a future option. Any suggestions to improve the "not recommended" approach would be greatly appreciated.

Thank you.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...