https://community.splunk.com/t5/Getting-Data-In/how-to-filter-and-forward-to-multiple-destination/m-p/326821#M60723 <P>Hello,</P> <P>I tried this configuration but it ended up badly, there were no more log on Splunk:</P> <PRE><CODE>[pan:log] TRANSFORMS-host = paloalto_hostoverride TRANSFORMS-routing = IndexersRouting, Routing-PA-filterhost [Routing-PA-filterhost] SOURCE_KEY = MetaData:Host REGEX=^(?!(GSBDCL-FW950)$).*$ DEST_KEY=_TCP_ROUTING FORMAT= Routing-PA [IndexersRouting] REGEX=. DEST_KEY=_TCP_ROUTING FORMAT= indexersRouting </CODE></PRE> <P>I also tried to reverse the TRANSFORMS-routing order and there was less logs than usual.<BR /> the regex works and the inputs.conf I have set</P> <PRE><CODE> connection_host = none </CODE></PRE> <P>Is it possible that my transform-host is not applied before my transform-routing so that the SOURCE_KEY = MetaData:Host is useless?<BR /> Or do I need to set a specific order in the Transform-routing??</P> <P>back to the original config which actually works:</P> <PRE><CODE>TRANSFORMS-routing = Routing-PA [Routing-PA] REGEX=. DEST_KEY=_TCP_ROUTING FORMAT= Routing-PA, indexersRouting </CODE></PRE> Thu, 13 Apr 2017 09:00:25 GMT sassens1 2017-04-13T09:00:25Z https://community.splunk.com/t5/Getting-Data-In/how-to-filter-and-forward-to-multiple-destination/m-p/326821#M60723 <P>Hello,</P> <P>I tried this configuration but it ended up badly, there were no more log on Splunk:</P> <PRE><CODE>[pan:log] TRANSFORMS-host = paloalto_hostoverride TRANSFORMS-routing = IndexersRouting, Routing-PA-filterhost [Routing-PA-filterhost] SOURCE_KEY = MetaData:Host REGEX=^(?!(GSBDCL-FW950)$).*$ DEST_KEY=_TCP_ROUTING FORMAT= Routing-PA [IndexersRouting] REGEX=. DEST_KEY=_TCP_ROUTING FORMAT= indexersRouting </CODE></PRE> <P>I also tried to reverse the TRANSFORMS-routing order and there was less logs than usual.<BR /> the regex works and the inputs.conf I have set</P> <PRE><CODE> connection_host = none </CODE></PRE> <P>Is it possible that my transform-host is not applied before my transform-routing so that the SOURCE_KEY = MetaData:Host is useless?<BR /> Or do I need to set a specific order in the Transform-routing??</P> <P>back to the original config which actually works:</P> <PRE><CODE>TRANSFORMS-routing = Routing-PA [Routing-PA] REGEX=. DEST_KEY=_TCP_ROUTING FORMAT= Routing-PA, indexersRouting </CODE></PRE> Thu, 13 Apr 2017 09:00:25 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-filter-and-forward-to-multiple-destination/m-p/326821#M60723 sassens1 2017-04-13T09:00:25Z https://community.splunk.com/t5/Getting-Data-In/how-to-filter-and-forward-to-multiple-destination/m-p/326822#M60724 <P>You are overriding _TCP_ROUTING key. It is same concept as normal field. If you use same field name twice for same event in transforms.conf, the last field value would be taken. It is not appending. </P> <P>Maybe you try to create two tcpout group, </P> <P>If defaultGroup is indexerRouting and another tcpout group is Routing-PA, can't you make use of the working example ( FORMAT= Routing-PA, indexersRouting ) ? </P> Tue, 29 Sep 2020 13:43:44 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-filter-and-forward-to-multiple-destination/m-p/326822#M60724 Masa 2020-09-29T13:43:44Z https://community.splunk.com/t5/Getting-Data-In/how-to-filter-and-forward-to-multiple-destination/m-p/326823#M60725 <P>Hi,</P> <P>sorry but I don't get it, you're probably right about field overriding but how can I avoid it??<BR /> my goal is to forward all the logs to my indexers and all except a specific host to an external log collector.</P> <P>I already have 2 different tcpout groups with different destination IPs</P> <PRE><CODE>[tcpout] defaultGroup = indexersRouting autoLBFrequency = 30 forceTimebasedAutoLB = true autoLB = true [tcpout:Routing-PA] server = 10.175.1.2:514 sendCookedData = false disabled = false </CODE></PRE> Thu, 20 Apr 2017 12:21:01 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-filter-and-forward-to-multiple-destination/m-p/326823#M60725 sassens1 2017-04-20T12:21:01Z