Getting Data In

How can I override an index name based on sourcetype?

rphillips_splk
Splunk Employee
Splunk Employee

I want to override the index name of my events (assigned at the forwarder) with a new index name based on sourcetype.

1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

This can be done at the heavy forwarder or indexer:

On your indexer or heavy forwarder:

# etc/system/local/transforms.conf 
[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = .
FORMAT = my_new_index


#etc/system/local/props.conf 
[mysourcetype]
TRANSFORMS-index = overrideindex

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

This can be done at the heavy forwarder or indexer:

On your indexer or heavy forwarder:

# etc/system/local/transforms.conf 
[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = .
FORMAT = my_new_index


#etc/system/local/props.conf 
[mysourcetype]
TRANSFORMS-index = overrideindex

rphillips_splk
Splunk Employee
Splunk Employee

you must have the index already configured on the indexers in indexes.conf before sending events to the new index.

shan_santosh
Explorer

Can I do this based on specific host name, if yes, how?

0 Karma

MuS
SplunkTrust
SplunkTrust

Greetings from the future ...

Yes, you can specify a host name to be used in props.conf see the docs for more details https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#GLOBAL_SETTINGS

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...