Splunk Search

Route specific events to a relative index

Explorer

I need to retain events for different periods of time based on content. I have created indexes with different retentions, for example, audit_1YR, audit_2YR

I am using the advice in http://docs.splunk.com/Documentation/Splunk/6.6.3/Indexer/Setupmultipleindexes#Send_events_to_specif...

I can successfully redirect to different absolute indexes using config like the following on the Indexer
$SPLUNK_HOME/etc/system/local/props.conf:
[my_sourcetype]
TRANSFORMS-index = Retain2Year

$SPLUNK_HOME/etc/system/local/transforms.conf:
[Retain2Year]
REGEX = (2YR)
DEST_KEY = _MetaData:Index
FORMAT = Audit_2YR

What I would like to be able to do is make the new index name be relative to the passed index name set in the Splunk Universal Forwarder, by just suffixing the index name. For example, something like
FORMAT = existingIndexName_2YR

Is that possible? How can the existing index name be referenced in the FORMAT statement? I have tried the following, which all failed
FORMAT = $index.$1
FORMAT = index::$index.$1
FORMAT = _meta:index.$1

0 Karma
1 Solution

Explorer

I have this working now! The right reference was $0. The following statement is working for me
FORMAT=$0_2YR

I found the information at http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Data/Configureindex-timefieldextraction

View solution in original post

0 Karma

Explorer

I have this working now! The right reference was $0. The following statement is working for me
FORMAT=$0_2YR

I found the information at http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Data/Configureindex-timefieldextraction

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@wayn23 - We converted your comment to an answer, so you can mark the question as closed by accepting it. Happy splunking!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!