How to set an index dynamically

[a212830]

Hi,

Is is possible to set an index value dynamically?

I have the following paths:

/opt/fimt/../../filea

/opt/ctg/../../filea

/opt/fpcms/../../filea

More and more are going to be added in the future, and rather than hardcode values, we were thinking of setting a default index (main) and then setup a props/transforms to look at the second part of the path, and then, based upon that value, route the events to a certain index.

So, if the path included fimt, go to one index, ctg another.... Has anyone done something like this?

[rashi83]

@esix_splunk - IS there any way to index with correct app name is not there , then it should create that index on the fly.

[esix_splunk]

You can set this at index time based on the source metadata. Depending on your Splunk architecture, this will need to placed at the proper HF/IDX layer.

 [send_to_index_by_source1]
 SOURCE_KEY = MetaData:Source
 REGEX = ^source::/opt/fimt/../../filea
 DEST_KEY = _MetaData:Index
 FORMAT = myindex

See this post : https://answers.splunk.com/answers/148341/how-to-assign-syslog-file-to-specific-index-based-on-file-...

[a212830]

Thanks. My index name doesn't match what is that in that part of the path, so I can't just map them. Was thinking more along the lines of a case statement (or it's equivalent). Is that possible?

[sloshburch]

I don't understand. Is the index name always a certain part of the path? If not, maybe share more about where you want to pull the index name from.

[somesoni2]

The case statement equivalent here would be to create that many transforms stanza for each combination. [send_to_index_by_source1] [send_to_index_by_source2] ... for each variation of sources.

[a212830]

Thanks. Is there anyway to look at just the second part of the source path?

[somesoni2]

It will be like this

[send_to_index_by_source1]
  SOURCE_KEY = MetaData:Source
  REGEX = ^source::/opt/([^/]+)/../../filea
  DEST_KEY = _MetaData:Index
  FORMAT = index::$1