Is it possible to forward messages to different indexes based on the value of message field ?
And which forwarder is the most appropriate (Universal or Heavy) ?
Yes. Using props.conf
and transforms.conf
, you can achieve this. Please provide some sample data to perform regex matching. Otherwise, below is the basic structure of configuration settings for routing events.
Props.conf:
[your_custom_sourcetype]
TRANSFORMS-routing = routing_based_on_field_values
Transforms.conf:
[routing_based_on_field_values]
REGEX = <your_custom_regex>
DEST_KEY = _MetaData:Index
FORMAT = <alternate_index_name>
You can find more information in below links, let me know if this helps.
https://answers.splunk.com/answers/566448/route-specific-events-to-a-relative-index.html
In case of having a thousands of different values , I want to create thousands of indexes. Does it mean I have to declared thousands of stanzas.
Oh, you want to route each event with different value to a different index? I thought, you want to look for specific value in the raw events and route all the events which have this specific value to different index(s).
Yes, I want to forward events with different value to a different indexes.
Can you provide some sample events with values which you want to route.
{"name":"value1"},
{"name":"value2"},
....
{"name":"value1000"}
In this case, I want to forward events to 1000 indexes.
Are all these events coming from 1 source/host? Also, why do you want to forward each event to each index.
Sorry, I am looking for solution of this problem.