I have a configuration with a log root with several log files, most of these are harmless, but one file contains confidential information.
logroot\loga.log
logroot\logb.log
logroot\secure.log
my inputs.conf monitors logroot.
I then use props.conf to set the sourcetype, but I would like to be able to route the secure.log to a different index.
Do I have to use a transform, and use ressources on my indexer, or could I specify this in either props og inputs.conf and do the selection on the universalForwarder?
An easier alternative is to define a special inputs on your specific file that will setup the destination index.
A stanza that has an exact path will have precedence over one with a wilcard.
[monitor://logroot\*.log] sourcetype=mygenericsourcetype index=mygenericindex [monitor://logroot\secure.log] sourcetype=myspecificsourcetype index=myspecificindex
The files in the directory has different sourcetypes, so I need to set it on a per file basis.
An easier alternative is to define a special inputs on your specific file that will setup the destination index.
A stanza that has an exact path will have precedence over one with a wilcard.
[monitor://logroot\*.log] sourcetype=mygenericsourcetype index=mygenericindex [monitor://logroot\secure.log] sourcetype=myspecificsourcetype index=myspecificindex
Just FYI the generic with a blacklist and then a more specific monitor does not work in Splunk 6. Support has said it was never officially supported but the rules were a bit lose and have been tightened in 6.
Thanks, I will play around with this solution.
I would add a blacklist your generic monitor.
[monitor://logroot\*.log]
sourcetype=mygenericsourcetype
blacklist = secure.log$
index=mygenericindex
\
[monitor://logroot\secure.log]
sourcetype=myspecificsourcetype
index=myspecificindex
2 remarks :
Yes, that is why, I wondered if it was possible to do it earlier in the process, as it is not a per event filtering, but a per file.
Why are you using props.conf to set sourcetype? The easiest is to do this directly in inputs.conf. Same goes for index.