Getting Data In

How to segment syslog events by indexer?

vitorpedralli
Engager

Hi everyone,

I am trying to configure one way to segment syslog events by user.

Example:
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP01|...
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP02|...
Apr 11 13:30:38 10.0.11.10 IMP|ENVIRONMENT=XXX|SERVERGROUPNAME=SRVGP03|...

I would like to send all syslog with:
SERVERGROUPNAME=SRVGP01 to indexer X
SERVERGROUPNAME=SRVGP02 to indexer Y
SERVERGROUPNAME=SRVGP03 to indexer Z

How can I do that?

Thanks!
Vitor Pedralli

0 Karma

somesoni2
Revered Legend

Have a look at this:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Filter_and_route_ev...

This links gives you a sample configuration for routing event to different indexer (as defined in tcpout group in outputs.conf) based on keywords in the event's raw data.

Please note this needs to be setup on the first Splunk Enterprise instance in your data flow (if using Heavy Fwd, setup on those Or to be set on indexers).

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...