When "indexRouting" is set to "true", are only logs sent to HEC for which an corresponding index exists?

[crdn]

In Splunk Connect for Kubernetes Configuration, there is a parameter called "indexRouting".

splunk:
hec:

indexRouting: true

When "indexRouting" is set to "true", Splunk Connect sends the logs of a Kubernetes namespace to an index wich has the identical name as the namespace.

We only want to send the logs of specific namespaces to Splunk. So my question ist: Does Splunk Connect check if a corresponding index exists, before it sends all the logs of a namespace to Splunk?

In Splunk, only the logs of namespaces with a corresponding index are stored. So it makes no sense, to send the logs of namespaces, for which no corresponding index exists, to Splunk (over the network).

[yannK · Accepted solution]

HEC sender cannot check is the index exists on the receiver.
and HEC receiver dump events if the index does not exist, or if the token does not have permissions to ingest to the index.

[yannK]

on the indexer side, there is an optional setting for a catch-22 index, but I do not know if the HEC input will use it.

[crdn]

@yannK Thank you very much for the hint. Unfortunately I can not find any information about this catch-22 index option. What is the keyword to look after or do you have a link to the corresponding documentation.

[rmurali4u]

@crdn i am have also similar requirement. In the K8 there are two namespace client 1 and client2. Each namespace has set of micro-service application running. I want logs of each namespace (client) into a index ( which is same name as namespace). Were you able to solve the issues?

[crdn]

@rmurali4u Because I don't want to deviate from the splunk standard, I have opened a feature request. I hope that it will be implemented soon.