Splunk Search

Unmatched regex re-routing

jadengoho
Builder

How can i route this kind of data to there proper index.

Data:

transaction_1

transaction_2

transaction_01 

transaction_02

transaction_11

transaction_12

 

Condition:

transaction_1 - transation_non_zero (index name)

transaction_2 - transation_non_zero

transaction_01  - transation_w_zero

transaction_02 - transation_w_zero

transaction_11 - global_unmatched_index

transaction_12 - global_unmatched_index

 

global_unmatched_index - is an index where all data that does not matched (transation_non_zero,transation_w_zero) indexes are located.

Also the requirement is to use props and transforms

Labels (1)
Tags (1)
1 Solution

inventsekar
Ultra Champion

FOR - 
transaction_1 - transation_non_zero (index name)

transaction_11 - global_unmatched_index

transaction_12 - global_unmatched_index

 

props.conf 

[default] 
TRANSFORMS-routing=unmatchedRouting

[host::testHost] TRANSFORMS-transation_non_zero = transation_non_zero_routing

transforms.conf 

[unmatchedRouting]
REGEX=(transaction\_1[1|2])
DEST_KEY=_TCP_ROUTING
FORMAT=unmatchedRouting

[transation_non_zero_routing] SOURCE_KEY = MetaData:testHost DEST_KEY = _MetaData:transation_non_zero REGEX = (transaction\_1) FORMAT = transation_non_zero_routing

https://docs.splunk.com/Documentation/Splunk/8.1.0/Forwarding/Routeandfilterdatad

 

 Best Regards,

Sekar

View solution in original post

0 Karma

inventsekar
Ultra Champion

FOR - 
transaction_1 - transation_non_zero (index name)

transaction_11 - global_unmatched_index

transaction_12 - global_unmatched_index

 

props.conf 

[default] 
TRANSFORMS-routing=unmatchedRouting

[host::testHost] TRANSFORMS-transation_non_zero = transation_non_zero_routing

transforms.conf 

[unmatchedRouting]
REGEX=(transaction\_1[1|2])
DEST_KEY=_TCP_ROUTING
FORMAT=unmatchedRouting

[transation_non_zero_routing] SOURCE_KEY = MetaData:testHost DEST_KEY = _MetaData:transation_non_zero REGEX = (transaction\_1) FORMAT = transation_non_zero_routing

https://docs.splunk.com/Documentation/Splunk/8.1.0/Forwarding/Routeandfilterdatad

 

 Best Regards,

Sekar

0 Karma

to4kawa
Ultra Champion
_MetaData:Index     : The index where the event should be stored.

https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Transformsconf

Regular expressions require more information, so try to do it yourself.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...