Installation

Data Redirection Issue

daniel333
Builder

All,

I am getting logs into an existing Splunk installation with
index=wrong sourcetype=wayoutofdate

that data needs to continue as is. There are users counting on those logs as they are . I'd like to send a second copy of these logs to a new set of indexers with
index=correct sourcetype=correctsourctype

I am not sure how to make the three transform changes without breaking what already exists off my heavy forwarders. Any help?

0 Karma

ledion
Path Finder

You should be able to trivially clone the data into the right index/sourcetype and much much more using Cribl - check out this blog post for an example of how to clone data.

0 Karma

MousumiChowdhur
Contributor

Hi @daniel333 ,

Could you please share the outputs.conf stanza you have currently?

Thank You.

0 Karma

woodcock
Esteemed Legend

The easiest way is to create a symlink to the directory where the files are now ( ln -s current_directory symlink_directory ) and put a second monitor stanza pointed at the new directory. The downside is double the work on the forwarder and double the license cost.

The other way, which is extremely fragile and also creates much latency but has no license cost, is to use copy it into a summary index with a populating search that is scheduled to run all the time.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...