https://community.splunk.com/t5/Getting-Data-In/Routing-problem-with-props-and-transforms/m-p/306787#M57844 <P>Hi Woodcock,<BR /> I want all the logs to be send to existing indexes and only few to be send to new index.<BR /> Looking at this it might impact the existing indexes as well.</P> Fri, 31 Mar 2017 14:10:57 GMT chintan_shah 2017-03-31T14:10:57Z https://community.splunk.com/t5/Getting-Data-In/Routing-problem-with-props-and-transforms/m-p/306785#M57842 <P>Hi,</P> <P>I am having trouble for routing the logs to separate index using props and transforms.<BR /> With the below code on Splunk instance, all the logs are being send to guilogins index and not on earlier index. <BR /> Also all the logs on guilogins doesnt match with the REGEX.<BR /> Can any one please help me out?</P> <P>props.conf<BR /> TRANSFORMS-SET=allroute,loginroute</P> <P>Transforms.conf<BR /> [allroute]<BR /> REGEX = .*<BR /> DEST_KEY = queue<BR /> FORMAT = indexQueue</P> <P>[loginroute]<BR /> REGEX = .[GUI User Logged out|GUI New User Logged In].*<BR /> DEST_KEY = _MetaData:Index<BR /> FORMAT = guilogins</P> Thu, 30 Mar 2017 21:30:46 GMT https://community.splunk.com/t5/Getting-Data-In/Routing-problem-with-props-and-transforms/m-p/306785#M57842 chintan_shah 2017-03-30T21:30:46Z https://community.splunk.com/t5/Getting-Data-In/Routing-problem-with-props-and-transforms/m-p/306786#M57843 <P>Use this instead:</P> <PRE><CODE>TRANSFORMS-SET=loginroute </CODE></PRE> <P>And deploy to your Indexers and restart splunk instances there and check newly arriving events only (not old ones).</P> Thu, 30 Mar 2017 21:54:30 GMT https://community.splunk.com/t5/Getting-Data-In/Routing-problem-with-props-and-transforms/m-p/306786#M57843 woodcock 2017-03-30T21:54:30Z https://community.splunk.com/t5/Getting-Data-In/Routing-problem-with-props-and-transforms/m-p/306787#M57844 <P>Hi Woodcock,<BR /> I want all the logs to be send to existing indexes and only few to be send to new index.<BR /> Looking at this it might impact the existing indexes as well.</P> Fri, 31 Mar 2017 14:10:57 GMT https://community.splunk.com/t5/Getting-Data-In/Routing-problem-with-props-and-transforms/m-p/306787#M57844 chintan_shah 2017-03-31T14:10:57Z https://community.splunk.com/t5/Getting-Data-In/Routing-problem-with-props-and-transforms/m-p/306788#M57845 <P>Hi there, I believe you should change the regular expresion on the loginroute stanza, if I'm not mistaken that regex matches more than you want.</P> <P>Try this <CODE>(GUI\sUser\sLogged\sout|GUI\sNew\sUser\sLogged\sIn)</CODE></P> Fri, 31 Mar 2017 14:22:54 GMT https://community.splunk.com/t5/Getting-Data-In/Routing-problem-with-props-and-transforms/m-p/306788#M57845 alemarzu 2017-03-31T14:22:54Z https://community.splunk.com/t5/Getting-Data-In/Routing-problem-with-props-and-transforms/m-p/306789#M57846 <P>Hi Woodcock,</P> <P>I have updated the regex which was creating the issue and use your suggestion of TRANSFORMS-SET and it worked fine.</P> Fri, 31 Mar 2017 19:05:40 GMT https://community.splunk.com/t5/Getting-Data-In/Routing-problem-with-props-and-transforms/m-p/306789#M57846 chintan_shah 2017-03-31T19:05:40Z