Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Forward a subset of events from one splunk server to another, changing the index

$
0
0

On the server MyServer I have events coming into the index MyIndex from various sources. I want to tag a subset of these events and send them to OtherServer into the index OtherIndex.

So on MyServer in props.conf I have

[sourcetype_in_question]
TRANSFORMS-sendtoother = send_to_other

In transfoms.conf

[send_to_other]
REGEX = (.)
DEST_KEY = _TCP_ROUTING
FORMAT = send_to_other

In outputs.conf

[tcpout]
defaultGroup = nothing
indexAndForward = 1
disabled = 0

[tcpout:send_to_other]
server=other_server:9997
sendCookedData=false

My first issue is that if I set sendCookedData to true the receiving server gets nothing. My second issue is how to change the receiving index to OtherIndex. Should this be done on the other server?


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>