Hi everyone, I would like overwrite the host and indexer coming from my Splunk universal forwarder in my main indexer if they are from a specific IP address. The logs are coming from an internal network, so the fields IP are between 10.30.75.1 and 10.30.76.100. I write down a props.conf and a transforms.conf, but they are not actually working. Could someone help me? props: [subnetwork1] EXTRACT-extract_ip = (?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) TRANSFORMS-subnetwork1=subnetwork1 transforms: [subnetwork1] REGEX = (?<ip>\10\.\30\.\*\.\*) FORMAT = host::$1 INDEX=subnetwork1 Could someone help me? ... View more

Hi everyone, I'm in this situation: I have a Splunk instance installed on my VM. I would like to send data to another Splunk instance that contains an alert manager and is receiving and triggering data from another VM. On the first Splunk instance, I have installed the Splunk App for Unix and Linux that is triggering alerts. I would like get these and send them to the other Splunk indexer. To do this I though, there are 2 different ways. Could someone help me to understand which is the best one? Use the first Splunk instance as a heavy forwarder which will use the transforms.conf to edit the index of the event and send it to the receiving Splunk instance. Use the Splunk light forwarder, save the results of the alerts in a csv file, and send it to the receiving Splunk instance. Does someone of you know a better way to forward this kind of data? Thanks everyone, Federica ... View more