Getting Data In

how to route data from syslog servers to specific index??

saifuddin9122
Path Finder

Hello all

i have 3 syslog servers which are forwarding data on udp 7877

i want to route the data to different index. like
syslog1 --> index1
syslog2 --> index2
syslog3 --> index3

here is my inputs.conf

[udp://7877]
connection_host = dns

can any one help me ??

Thanks in Advance

0 Karma

yannK
Splunk Employee
Splunk Employee

The above answer from Adonio is good to rewrite the index for events at indextime using regexes, but if will have a parsing cost for each events.

Another option, if you can split your inputs is to create one udp port input for each index destination.
And have each syslog server send to a specific port.

example :

[udp://7877]  
connection_host = dns
index=index1 
sourcetype=mysyslogsourcetype


[udp://7878]  
connection_host = dns
index=index2
sourcetype=mysyslogsourcetype

[udp://7879]  
connection_host = dns
index=index3
sourcetype=mysyslogsourcetype

adonio
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...