Hi,
Is is possible to set an index value dynamically?
I have the following paths:
/opt/fimt/../../filea
/opt/ctg/../../filea
/opt/fpcms/../../filea
More and more are going to be added in the future, and rather than hardcode values, we were thinking of setting a default index (main) and then setup a props/transforms to look at the second part of the path, and then, based upon that value, route the events to a certain index.
So, if the path included fimt, go to one index, ctg another.... Has anyone done something like this?
@esix_splunk - IS there any way to index with correct app name is not there , then it should create that index on the fly.
You can set this at index time based on the source metadata. Depending on your Splunk architecture, this will need to placed at the proper HF/IDX layer.
[send_to_index_by_source1]
SOURCE_KEY = MetaData:Source
REGEX = ^source::/opt/fimt/../../filea
DEST_KEY = _MetaData:Index
FORMAT = myindex
See this post : https://answers.splunk.com/answers/148341/how-to-assign-syslog-file-to-specific-index-based-on-file-...
Thanks. My index name doesn't match what is that in that part of the path, so I can't just map them. Was thinking more along the lines of a case statement (or it's equivalent). Is that possible?
I don't understand. Is the index name always a certain part of the path? If not, maybe share more about where you want to pull the index name from.
The case statement equivalent here would be to create that many transforms stanza for each combination. [send_to_index_by_source1] [send_to_index_by_source2] ... for each variation of sources.
Thanks. Is there anyway to look at just the second part of the source path?
It will be like this
[send_to_index_by_source1]
SOURCE_KEY = MetaData:Source
REGEX = ^source::/opt/([^/]+)/../../filea
DEST_KEY = _MetaData:Index
FORMAT = index::$1