About MediumToast

MediumToast · ‎07-31-2024

Thanks for the response. Maciek Stopa on the Splunk Slack workspace provided this novel code that has worked well. This doesn't handled the metrics and sc4s events but I handled those in splunk_metadata.csv. # cp example_postfiler.conf /opt/sc4s/local/config/app_parsers/ # systemctl restart sc4s block parser app-dest-rewrite-index() { channel { rewrite { r_set_splunk_dest_update_v2( index("${.splunk.index}_unique-suffix") ); }; }; }; application app-dest-rewrite-index[sc4s-postfilter] { parser { app-dest-rewrite-index(); }; };

MediumToast · ‎07-29-2024

Hi, Apologies if I'm using the wrong terminology here. I'm trying to configure SC4S to override the destination indexes of types of sources. For example, if an event is received from a Cisco firewall by default it'll end up in the 'netfw' index. Instead, I want all events that would have gone to 'netfw' to go to, for example, 'site1_netfw'. I attempted to do this using the splunk_metadata.csv file but I now understand I've misinterpreted the documentation. I had used 'netfw,index,site1_netfw' but if I understand correctly, I'd actually need to have a seperate line for each key such as 'cisco_asa,index,site1_netfw'. Is that correct? Is there a way to accomplish what I want without listing each source key? Thanks

Posts	2
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎07-29-2024

Online Status	Offline
Date Last Visited	‎08-01-2024 12:26 PM

Overriding indexes of sources in SC4S

Re: Overriding indexes of sources in SC4S

Overriding indexes of sources in SC4S