https://community.splunk.com/t5/Getting-Data-In/Selective-routing-to-UDP-without-indexing/m-p/689880#M114801 <P>Hello Splunkers,&nbsp;</P><P>Please I would like to know if it is possible, at indexer layer, given a HEC input source, to route some incoming data (of course based on regex) to a UDP destination without indexing that data.</P><P>Let's say: sourcetype=hecinput, if it contains word "DEBUG" it should go to UDP destination, all the rest should be indexed as usual.</P><UL><LI>I know that maybe I could use INGEST_EVAL, but I think it supports only _TCP_ROUTING.&nbsp;</LI></UL><P>Thanks in advance.&nbsp;</P> Thu, 06 Jun 2024 23:11:38 GMT cafissimo 2024-06-06T23:11:38Z https://community.splunk.com/t5/Getting-Data-In/Selective-routing-to-UDP-without-indexing/m-p/689880#M114801 <P>Hello Splunkers,&nbsp;</P><P>Please I would like to know if it is possible, at indexer layer, given a HEC input source, to route some incoming data (of course based on regex) to a UDP destination without indexing that data.</P><P>Let's say: sourcetype=hecinput, if it contains word "DEBUG" it should go to UDP destination, all the rest should be indexed as usual.</P><UL><LI>I know that maybe I could use INGEST_EVAL, but I think it supports only _TCP_ROUTING.&nbsp;</LI></UL><P>Thanks in advance.&nbsp;</P> Thu, 06 Jun 2024 23:11:38 GMT https://community.splunk.com/t5/Getting-Data-In/Selective-routing-to-UDP-without-indexing/m-p/689880#M114801 cafissimo 2024-06-06T23:11:38Z https://community.splunk.com/t5/Getting-Data-In/Selective-routing-to-UDP-without-indexing/m-p/689882#M114803 <P>Addendum:</P><P>No solution found yet</P> Wed, 19 Jun 2024 08:46:15 GMT https://community.splunk.com/t5/Getting-Data-In/Selective-routing-to-UDP-without-indexing/m-p/689882#M114803 cafissimo 2024-06-19T08:46:15Z