Hi,
I have 4 forwarders, 4 search heads, and 2 forwarders in my Splunk cluster. Now one of the forwarders is configured to read data from UDP port 514. The data comes in to the forwarder and it then is forwarded to the indexers.
Now I need to apply configurations in transforms.conf and props.conf to write few events into a separate index by host. Where do I put those configurations? Should I do the changes in the forwarder or the indexer?
Thanks.
Hi allan_newton,
try something like this,un-tested and out of my head:
props.conf
[source::udp:514]
TRANSFORMS-001_changemetadata = redirect_to_index_foo
transforms.conf
[redirect_to_index_foo]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(10.10.10.d+)$
FORMAT = foo
DEST_KEY = _MetaData:Index
Don't forget to restart the forwarder after you changed the props and transforms.
Hope this helps ...
cheers, MuS
Hi allan_newton,
try something like this,un-tested and out of my head:
props.conf
[source::udp:514]
TRANSFORMS-001_changemetadata = redirect_to_index_foo
transforms.conf
[redirect_to_index_foo]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(10.10.10.d+)$
FORMAT = foo
DEST_KEY = _MetaData:Index
Don't forget to restart the forwarder after you changed the props and transforms.
Hope this helps ...
cheers, MuS
Instead of ^host::(10.10.10.d+)$ can i use host::(10.10.10.32) ?