Hi everyone,
I am trying to configure one way to segment syslog events by user.
Example:
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP01|...
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP02|...
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP03|...
I would like to send all syslog with:
SERVERGROUPNAME=SRVGP01 to indexer X
SERVERGROUPNAME=SRVGP02 to indexer Y
SERVERGROUPNAME=SRVGP03 to indexer Z
How can I do that?
Thanks!
Vitor Pedralli
... View more