Getting Data In

How to split events from the same log into different indexes based on content?

himynamesdave
Contributor

I have a log that contains different customer IDs. I want to be able to split different events from the same log into different Splunk indexes depending on the customer ID.

The customer IDs are fairly static. Hence right now I'm thinking of placing customer IDs in a lookup and using this to route events. Is this possible?

Can anyone give any advice on how they have (or would) approach and execute something like this.

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi himynamesdave,

Use props.conf and transforms.conf for this..

 #props.conf
 [source]
 TRANSFORMS-routing_for_norris_index = route_to_norris_index

 #transforms.conf
 [route_to_norris_index]
 DEST_KEY = _MetaData:Index
 REGEX = chuck
 FORMAT = norris

This will route all events containing chuck into the norris index.

Cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi himynamesdave,

Use props.conf and transforms.conf for this..

 #props.conf
 [source]
 TRANSFORMS-routing_for_norris_index = route_to_norris_index

 #transforms.conf
 [route_to_norris_index]
 DEST_KEY = _MetaData:Index
 REGEX = chuck
 FORMAT = norris

This will route all events containing chuck into the norris index.

Cheers, MuS

vinayakwagh
Engager

what about remaining event in which index they will go?

0 Karma

MuS
SplunkTrust
SplunkTrust

The remaining events that do not match the regex chuck will go into their configured index in inputs.conf (best practice) or into the configured default index of your Splunk (not best practice).

Hope this helps ...

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

Do this on the Splunk server which is doing event parsing eq a heavy forwarder or indexer http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...