Heavy Forwarder: How do I get traffic to a specific index on my indexer?

[catsmeowor]

Hi Folks - testing the product out and trying to figure out this scenario.

Windows Server w/ Universal Forwarder --> Heavy Forwarder --> Specific Index on Indexer

Most of the above works and I have filtering based on specific events and account names are working too, the next step is getting traffic to a specific index on my indexer.

How do I do this? Referenced articles are not working.

On the indexer, I've created a new index 'winevents'

On props.conf

 [source::*:Security]
 TRANSFORMS-set = setnull,seclog

On my transforms.conf I've got:

 [seclog]
 REGEX = (?msi)(^EventCode=4634|4632).*(Account\sName:\t\tSUPER.)
 DEST_KEY = queue
 FORMAT = indexQueue

From what I understand 'format' should equal the new index name? FORMAT = winevents

That's not working.

[harsmarvania57]

Your props.conf and transforms.conf should be on HF, not on Indexer because parsing occurres on first full Splunk Enterprise instance from UF to Indexer.

[mdsnmss]

What you want to do is set the DEST_KEY to what value you want the FORMAT to change. Try:

 [seclog]
  REGEX = (?msi)(^EventCode=4634|4632).*(Account\sName:\t\tSUPER.)
  DEST_KEY = _MetaData:Index
  FORMAT = index::winevent

[catsmeowor]

Unfortunately this does not work. No more events after making those changes, restarting everything.

Change it back to transforms.conf

[seclog]
REGEX = (?msi)(^EventCode=4634|4632).*(Account\sName:\t\tSUPER.)
DEST_KEY = queue
FORMAT = indexQueue

And specifying the index on the inputs.conf on the Windows host appears to work. Have not been able to figure out how to do it from the HF.

[catsmeowor · Accepted solution]

Figured it out, inputs.conf on the indexer:

[WinEventLog]
index = winevents

At least I think I figured it out, still testing.

[mdsnmss]

This will work if you want all WinEventLog events in the "winevents" index. The other method I posted will work to direct events on an event-by-event basis determined by the regex.

You can also put these settings at the HF level. Typically you want to apply settings as high up in the pipeline as possible. If using a UF you could specify index in inputs.conf but would have to use the props.conf/tranforms.conf at the indexer for my other solution. Let me know if you have any questions!