set indexes dynamically in inputs.conf

sbattista — Mon, 02 Aug 2021 14:25:55 GMT

I was able to set indexes dynamically in inputs.conf based off the source path folder name however, it seems like its not working in Splunk cloud. I have tried to upload a app with the props and transforms and also tried to use a HWF as well. hoping someone out there might be able to help.

this is basically what my conf files look like-

-props-

[source::\\fileshare\\folder\\...]
TRANSFORMS=send_to_index_by_source

-transforms-

[send_to_index_by_source]
SOURCE_KEY=_MetaData:Source
REGEX=\\\wfileshare\\\wfolder\\(\w+)
DEST_KEY=_MetaData:Index
FORMAT=$1

-inputs-

[monitor://\\fileshare\folder\...\test15.txt]
disabled=false
recursive=true
sourcetype=test15

topic set indexes dynamically in inputs.conf in Getting Data In

set indexes dynamically in inputs.conf