Hi everyone !
I'm new to Splunk and I'm trying to see what can be done with it. I was wondering if it was possible, with a heavy forwarder, to forward data to different indexes depending on the value of a specific field?
For example, if I have the indexes red_colored_vegetables and green_colored_vegetables, and the following data :
| Id | Vegetable | Color |
| 1 | Tomato | Red |
| 2 | Leek | Green |
| 3 | Salad | Green |
I want that 1 is forwarded to the index red_colored_vegetables and that 2 and 3 are forwarded to the index green_colored_vegetables.
Is it feasible?
Thanks !
↧