Hello,
I've been trying to get Websense data to go into two different indexes based on whether or not the action was blocked. The reason I am doing this is because Websense is generating ~7GB of data every day, which is too much for the HDDs on the indexer to handle.
I've set up all my .confs in $SPLUNK_HOME/etc/apps/search/local. Here are the relevant lines:
Inputs.conf
[udp://514]
connection_host = ip
host = xx.xx.x.xxx
sourcetype = websense_summary
props.conf
[host::xx.xx.x.xxx]
NO_BINARY_CHECK = true
TRANSFORMS-websense = setBlockedIndex, setPermittedIndex
transforms.conf
[setBlockedIndex]
DEST_KEY = MetaData:Index
REGEX = action\s*=\s*blocked
FORMAT = index::WebsenseBlocked
[setPermittedIndex]
DEST_KEY = MetaData:Index
REGEX = .
FORMAT = index::WebsensePermitted
When I look for the data, it shows up in index=main, instead of the assigned indexes.
I believe you just have a typo in your DEST_KEY and you can strip 'index:' off the FORMAT portion.
DEST_KEY = _MetaData:Index FORMAT = myindex
See this section from transforms.conf.spec
_MetaData:Index : The index where the event should be stored.
I believe you just have a typo in your DEST_KEY and you can strip 'index:' off the FORMAT portion.
DEST_KEY = _MetaData:Index FORMAT = myindex
See this section from transforms.conf.spec
_MetaData:Index : The index where the event should be stored.
I agree.
Please keep in mind that host stanza in props.conf cannot be defined by host field in inputs.conf. If you're looking for a certain source ip address who is sending udp packets, you need to specify the source IP.