Getting Data In

routing problem

dikaye
Path Finder

I have a FW server and the indexer server, the FW server use UDP 514 to receive all logs send from the remote devices, and the indexer server use tcp 9997 to receive all logs forward from the FW server, in the FW server and indexer server side, my props.conf are the same like that:

[host::211.167.20.156]
index = ironport_index

[host::211.167.20.29]
index = test_index1

[host::212.171.24.*]
index = test_index2

[host::212.171.214.165]
index = cisco_asa_

[syslog]
TRANSFORMS-routing = to_test_index3

And the transforms.conf like that:

[to_test_index3]
REGEX = ^\S+\s+\d+\s+\d+:\d+:\d+\s+192\.168\.2\.*
DEST_KEY = _MetaData:Index
FORMAT = test_index3

But it seems all logs don't go to the specify indexes, all go to the main index, I don't know why, do you have any idea? thanks.

Tags (1)
0 Karma

jrodman
Splunk Employee
Splunk Employee

While it may seem counterintuitive, index = foo in props.conf has no meaning. The code won't do anything on that basis.

In order to get the index to be set based on the host key in your data, there must be a TRANSFORMS key pointing to a transform stanza.

At the input layer, controlled by inputs.conf, you can pre-set the target index for all data that input stanza receives, which is where you may have picked up this pattern.

In this type of arrangement, I think you want to use the same TRANSFORMS-routing key for all four stanzas, set to different values, so that the stanza layering system simply selects a different transform for each data category. Eg.

[host::211.167.20.156]
TRANSFORMS-routing = to_ironport_index

[host::211.167.20.29]
TRNAFORMS-routing = to_test_index1

[host::212.171.24.*]
TRANSFORMS-routing = to_test_index2

[host::212.171.214.165]
TRANSFORMS-routing = to_cisco_asa_index

[syslog]
TRANSFORMS-routing = to_test_index3

With transforms.conf entries for each that probably look something like:

[to_ironport_index]
SOURCE_KEY=_raw
REGEX=.
DEST_KEY=_MetaData:Index
FORMAT=ironport
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...