Hi Guys,
May I know how to make syslog data from a specific IP (in this case Cisco WLC) to be inserted into a specific index? I already forwarded the syslog into Splunk, but somehow it falls into the wrong index. From the WLC side, unfortunately it cannot specify the syslog port. I did created the index and forward the syslog from WLC to Splunk. But not sure how to connect the data into the index. Thank you.
Hi @fdharmawan,
you have to insert in your Indexers and (if present) Heavy Forwarders, the following files:
In $SPLUNK_HOME/etc/system/local/transforms.conf
[overrideindex]
DEST_KEY =_MetaData:Index
REGEX = .
FORMAT = my_new_index
In $SPLUNK_HOME/etc/system/local/props.conf
[host::your_ip_address]
TRANSFORMS-index = overrideindex
In addition I hint, you could create a dedicated app and insert these props.conf and transforms.conf in it: $SPLUNK_HOME/etc/apps/your_app/local
Ciao.
Giuseppe