https://community.splunk.com/t5/Getting-Data-In/Index-for-specific-hosts-except-for-splunkd-sourcetype/m-p/72250#M14735 <P>I have setup a props.conf with: <BR /> [host::server*]<BR /> TRANSFORMS-movetonewindex = newindex</P> <P>And a transforms.conf with:<BR /> [newindex]<BR /> REGEX = .*<BR /> DEST_KEY = _MetaData:Index<BR /> FORMAT = new</P> <P>How do I not send the splunkd sourcetype to the "new" index and let it go to where it normally goes?</P> Wed, 15 Feb 2012 21:45:34 GMT jfaldmo 2012-02-15T21:45:34Z https://community.splunk.com/t5/Getting-Data-In/Index-for-specific-hosts-except-for-splunkd-sourcetype/m-p/72250#M14735 <P>I have setup a props.conf with: <BR /> [host::server*]<BR /> TRANSFORMS-movetonewindex = newindex</P> <P>And a transforms.conf with:<BR /> [newindex]<BR /> REGEX = .*<BR /> DEST_KEY = _MetaData:Index<BR /> FORMAT = new</P> <P>How do I not send the splunkd sourcetype to the "new" index and let it go to where it normally goes?</P> Wed, 15 Feb 2012 21:45:34 GMT https://community.splunk.com/t5/Getting-Data-In/Index-for-specific-hosts-except-for-splunkd-sourcetype/m-p/72250#M14735 jfaldmo 2012-02-15T21:45:34Z https://community.splunk.com/t5/Getting-Data-In/Index-for-specific-hosts-except-for-splunkd-sourcetype/m-p/72251#M14736 <P>You could just do this:</P> <P>props.conf<BR /> <CODE><BR /> [splunkd]<BR /> TRANSFORMS-stayput = leaveitalone<BR /> </CODE></P> <P>transforms.conf<BR /> <CODE><BR /> [leaveitalone]<BR /> REGEX = .*<BR /> DEST_KEY = _MetaData:Index<BR /> FORMAT = _internal<BR /> </CODE></P> Wed, 15 Feb 2012 22:17:19 GMT https://community.splunk.com/t5/Getting-Data-In/Index-for-specific-hosts-except-for-splunkd-sourcetype/m-p/72251#M14736 Lamar 2012-02-15T22:17:19Z