Getting Data In

Why are events not routing to specific index based on host?

zayers2
Explorer

We have radius servers that need to be routed to a specific index. I have written the props.conf and transforms.conf Stanzas and I cannot get them to work. Our indexers are clustered and I made the changes to the .conf files on the cluster master in the directory:

$SPLUNK_HOME\etc\master-apps\_cluster\local\

props.conf

[host::coradius.*]
TRANSFORMS-index = coradius_index_transform

transforms.conf

[coradius_index_transform]
SOURCE_KEY = _MetaData:Host
REGEX = ^host::(coradius.*)$
DEST_KEY = _MetaData:Index
FORMAT = radius

Even after making those changes there are no events in the index. I need some help figuring out why the events from the specific hosts aren't routing to the correct index.

0 Karma
1 Solution

somesoni2
Revered Legend

Your transforms.conf stanza should be like this

[coradius_index_transform]
 SOURCE_KEY = MetaData:Host
 REGEX = ^coradius.*$
 DEST_KEY = _MetaData:Index
 FORMAT = radius

View solution in original post

somesoni2
Revered Legend

Your transforms.conf stanza should be like this

[coradius_index_transform]
 SOURCE_KEY = MetaData:Host
 REGEX = ^coradius.*$
 DEST_KEY = _MetaData:Index
 FORMAT = radius

zayers2
Explorer

I tried that, and it unfortunately didn't work. I modified the transforms.conf in the cluster master's directory: $SPLUNK_HOME\etc\master-apps_cluster\local\

and pushed the configuration to the two indexers, i checked and made sure the config files were there. I cannot figure out why it isn't working.

0 Karma

somesoni2
Revered Legend

What kind of forwarders do you have in your environment? This settings needs to be applied to place/instance where data parsing happens, so if you're using heavy forwarder (Splunk Enterprise instance as forwarder) OR heavy Intermediate Forwarder (Splunk Enterprise instance which receives data from Universal Forwarder and send it to Indexers), then this should be applied there.

0 Karma

zayers2
Explorer

We are using the Universal Forwarder on our servers and sending them to an indexer. The indexer is where the data parsing takers place.

0 Karma

somesoni2
Revered Legend

Since your transforms is applied to specified hosts already, give this a try.
props.conf

[host::coradius*]
 TRANSFORMS-index = coradius_index_transform

transforms.conf

 [coradius_index_transform]
 REGEX = .
 DEST_KEY = _MetaData:Index
 FORMAT = radius

zayers2
Explorer

That solved it! Thank you very much for your input.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...