https://community.splunk.com/t5/Getting-Data-In/transforms-conf/m-p/526428#M88803 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/164779">@VijaySrrie</a>,</P><P>you cannot put in the same stanza more times the same option, only once; so you have to find one single regex to identify the three groups in index names.</P><P>Ciao.</P><P>Giuseppe</P><P>&nbsp;</P> Mon, 26 Oct 2020 08:48:54 GMT gcusello 2020-10-26T08:48:54Z https://community.splunk.com/t5/Getting-Data-In/transforms-conf/m-p/526427#M88802 <P>Please help me with the transforms.conf</P><P>Available indexes details</P><P>index_pr_prod</P><P>index_ee_psvt</P><P>index_np_psup</P><P>&nbsp;</P><P>Index has 3 parts, 1st part is same , 2nd part we need to derive from host and 3rd part we need to derive from asset_env</P><P>I tried the below transforms but it did not work, do we need two different stanza configs in transforms.com?</P><P>[change_index_name]<BR />SOURCE_KEY = MetaData:Host<BR />REGEX = ^host::\w{12}(?i)(ee|pr|ps)<BR />DEST_KEY = _MetaData:Index<BR />SOURCE_KEY = MetaData:Asset_Env<BR />REGEX = ^asset_env::\w{5}<BR />DEST_KEY = _MetaData:Index<BR />FORMAT = index_$1_$2</P> Mon, 26 Oct 2020 08:40:43 GMT https://community.splunk.com/t5/Getting-Data-In/transforms-conf/m-p/526427#M88802 VijaySrrie 2020-10-26T08:40:43Z https://community.splunk.com/t5/Getting-Data-In/transforms-conf/m-p/526428#M88803 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/164779">@VijaySrrie</a>,</P><P>you cannot put in the same stanza more times the same option, only once; so you have to find one single regex to identify the three groups in index names.</P><P>Ciao.</P><P>Giuseppe</P><P>&nbsp;</P> Mon, 26 Oct 2020 08:48:54 GMT https://community.splunk.com/t5/Getting-Data-In/transforms-conf/m-p/526428#M88803 gcusello 2020-10-26T08:48:54Z