Getting Data In

Forward specific index to a specific receiver

ddarmand
Communicator

Hello,

i have three index : A, B, C on my heavy forwarder and i want to forward to different receiver,

example : A to X, B to Y and C to Y too

How can i do that ?

Thanks,

0 Karma
1 Solution

lguinn2
Legend

First, if you actually have indexes on your forwarder - it isn't just a forwarder anymore, it is also an indexer and it needs a license.

Second, if you can, route the events to the receiver based on sourcetype or source or host - not index, if possible:

props.conf

[sourcetypeA1]
TRANSFORM-a1=routeToReceiverX

[sourcetypeA2]
TRANSFORM-a2=routeToReceiverX

[sourcetypeB]
TRANSFORM-b1=routeToReceiverY

etc

transforms.conf

[routeToReceiverX]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=ReceiverXGroup

etc

outputs.conf

[tcpout:ReceiverXGroup]
server=ReceiverX:9997

[tcpout:ReceiverYGroup]
server=ReceiverY:9997

If you must route based on index, do this in props.conf and transforms.conf instead (outputs.conf stays the same):

props.conf

[host::*]
TRANSFORM-h1=routeToReceiverX,routeToReceiverY,routeToReceiverZ

transforms.conf

[routeToReceiverX]
SOURCE_KEY=_MetaData:Index
REGEX=A
DEST_KEY=_TCP_ROUTING
FORMAT=ReceiverXGroup

[routeToReceiverY]
SOURCE_KEY=_MetaData:Index
REGEX=B
DEST_KEY=_TCP_ROUTING
FORMAT=ReceiverYGroup

I am not entirely sure that this second method will work...

Here is a link to the documentation on Route and filter data

View solution in original post

lguinn2
Legend

First, if you actually have indexes on your forwarder - it isn't just a forwarder anymore, it is also an indexer and it needs a license.

Second, if you can, route the events to the receiver based on sourcetype or source or host - not index, if possible:

props.conf

[sourcetypeA1]
TRANSFORM-a1=routeToReceiverX

[sourcetypeA2]
TRANSFORM-a2=routeToReceiverX

[sourcetypeB]
TRANSFORM-b1=routeToReceiverY

etc

transforms.conf

[routeToReceiverX]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=ReceiverXGroup

etc

outputs.conf

[tcpout:ReceiverXGroup]
server=ReceiverX:9997

[tcpout:ReceiverYGroup]
server=ReceiverY:9997

If you must route based on index, do this in props.conf and transforms.conf instead (outputs.conf stays the same):

props.conf

[host::*]
TRANSFORM-h1=routeToReceiverX,routeToReceiverY,routeToReceiverZ

transforms.conf

[routeToReceiverX]
SOURCE_KEY=_MetaData:Index
REGEX=A
DEST_KEY=_TCP_ROUTING
FORMAT=ReceiverXGroup

[routeToReceiverY]
SOURCE_KEY=_MetaData:Index
REGEX=B
DEST_KEY=_TCP_ROUTING
FORMAT=ReceiverYGroup

I am not entirely sure that this second method will work...

Here is a link to the documentation on Route and filter data

ddarmand
Communicator

thanks lguinn,

Damien

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...