Hi everyone.
Obviously I am missing something.
I would like this specific sourcetype to be directed to a specific index, but I can't make it work.
Here's what I have.
INPUTS.CONF
[monitor://C:\logs]
disabled = 0
sourcetype = dirsync
recursive = false
PROPS.CONF
[dirsync]
TRANSFORMS-8_AssignToIndex = dirsync_setindex_default
TRANSFORMS.CONF
[dirsync_setindex_default]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = dirsync
I have the index "dirsync" on Splunk, of course.
All the logs are currently going to the main index. Sigh....
Thank you!
Claudio
Other than adjusting your inputs your approach seems correct. The questions I would ask is are those props and transforms on the indexer(s) and have they been restarted? That is still one area where it often takes a reboot to kick in. We've also run into issues in the past where we've had to have the regex 'see' something. You might try adjusting that to something as basic as ^(.)
In the inputs.conf you can add the following:
[monitor://C:logs]
disabled = 0
sourcetype = dirsync
recursive = false
index = my_new_index
see http://docs.splunk.com/Documentation/Splunk/6.1.3/admin/inputsconf for additional documentation.