Getting Data In

How to route events from a single host to multiple indexes?

Yaichael
Communicator

Hi Splunk Community,

I've the following scenario where I would like to route the events (JSON format) coming from a hostA to indexes A, B, and C. If the field value or string testA appears in the events, route to indexA, then if testB appears, route to indexB, and so on using props.conf and transforms.conf files in the Indexer.

Thanks for the help!

0 Karma
1 Solution

alemarzu
Motivator

Hello @Yaichael
I believe this should work.

props.conf

[host::HOSTA]
TRANSFORMS-route_events_hosta = route_events_to_indexA

[host::HOSTB]
TRANSFORMS-route_events_hostb = route_events_to_indexB

transforms.conf

[route_events_to_indexA]
REGEX = <regex to match textA>
FORMAT = indexA
DEST_KEY = _MetaData:Index

[route_events_to_indexB]
REGEX = <regex to match textB>
FORMAT = indexB
DEST_KEY = _MetaData:Index

Hope it helps.

View solution in original post

alemarzu
Motivator

Hello @Yaichael
I believe this should work.

props.conf

[host::HOSTA]
TRANSFORMS-route_events_hosta = route_events_to_indexA

[host::HOSTB]
TRANSFORMS-route_events_hostb = route_events_to_indexB

transforms.conf

[route_events_to_indexA]
REGEX = <regex to match textA>
FORMAT = indexA
DEST_KEY = _MetaData:Index

[route_events_to_indexB]
REGEX = <regex to match textB>
FORMAT = indexB
DEST_KEY = _MetaData:Index

Hope it helps.

Yaichael
Communicator

Here's the sample of the string to match.

{"quarantined" : false,"targetPriorityType" : "MEDIUM","deviceOwnerId" : 72622,"deviceGuid" : null,"email" : "test@test.net",
"deviceSessionId" : null,"assignedToId" : null,"assignedToName" : null,"deviceType" : "WINDOWS","activationCode" : "CODE","firstName" : null,
"lastName" : null,"middleName" : null,"createTime" : null,"lastReportedTime" : 1502916617373,"deviceId" : 235183,"organizationId" : 000,
"lastVirusActivityTime" : 0,"firstVirusActivityTime" : 0,"osVersion" : "Windows 10 x64","activationCodeExpiryTime" : 1496944516188,
"organizationName" : "COMPANY","sensorVersion" : "X.X.X.X","registeredTime" : 1496339794497,"lastContact" : 1502917965783,
"windowsPlatform" : null,"vdiBaseDevice" : null,"avStatus" : [ "AV_ACTIVE","ONDEMAND_SCAN_DISABLED" ],"deregisteredTime" : null,
"sensorStates" : [ "ACTIVE","SECURITY_CENTER_OPTLN_DISABLED" ],"messages" : null,"rootedBySensor" : false,"rootedBySensorTime" : null,
"lastInternalIpAddress" : "192.168.X.X","lastExternalIpAddress" : "X.X.X.X","lastLocation" : "OFFSITE","sensorOutOfDate" : false,
"avUpdateServers" : null,"passiveMode" : false,"lastResetTime" : 0,"lastShutdownTime" : 1497873764155,"scanStatus" : null,
"scanLastActionTime" : 0,"scanLastCompleteTime" : 0,"linuxKernelVersion" : null,
"avEngine" : "X.X.X.X-ave.X.X.X.X:avpack.X.X.X.X:vdf.X.X.X.X","avProductVersion" : "X.X.X.X","avAveVersion" : "X.X.X.X",
"avPackVersion" : "X.X.X.X","avVdfVersion" : "X.X.X.X","avLastScanTime" : 0,"rootedByAnalytics" : false,"rootedByAnalyticsTime" : null,
"testId" : -1,"avMaster" : false,"uninstalledTime" : null,"encodedActivationCode" : null,"name" : "TEST-PC","status" : "REGISTERED",
"policyName" : "TEST","policyId" : 8287}
0 Karma

alemarzu
Motivator

Ok then, try like this.

 REGEX = (?ms)\,\"name\"\s+:\s+\"TEST-PC\"\.\"status\"\s+:

This would match the event by the "name" value "TEST-PC"

Another example to match by "policyName" would be.

  REGEX = (?ms)\"policyName\"\s+:\s+\"TEST\"\,\"policyId\"
0 Karma

Yaichael
Communicator

Sorry for the late response, alemarzu.

The regex worked. Thanks for all your help!

0 Karma

alemarzu
Motivator

I'm glad it worked out for you. Happy Splunking!

0 Karma

Yaichael
Communicator

Hi alemarzu,

Thanks that helps, but in my case, it would be from a single host (hostA), but I get the idea.

I guess my issue is the regex to match the testA; it seems that putting testA, as it is, in REGEX doesn't do the trick.

Thanks!

0 Karma

alemarzu
Motivator

I can help you with the regular expression if you can share the string to match.

0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...