https://community.splunk.com/t5/Getting-Data-In/Redirection-to-different-index-using-transforms-conf/m-p/47188#M8966 <P>Hi,</P> <P>I have a couple of network devices which are sending logs to splunk over udp (so no forwarder installed on them).</P> <P>I'm struggling to get my transforms.conf to redirect the data to a separate index. <BR /> The network devices have 2 transforms rules, the first one being a MetaData:Host being set (instead of IP) which works fine. <BR /> What am I doing wrong for the index redirection? <BR /> Maybe some issue with SOURCE_KEY? I've tried using a SOURCE_KEY = MetaData:Host in transforms.conf</P> <P>transforms.conf<BR /> [host_rename_rt1]<BR /> REGEX = .<BR /> DEST_KEY = MetaData:Host<BR /> FORMAT = host::rt1</P> <P>[index_redirect_to_pci]<BR /> REGEX = .<BR /> DEST_KEY = MetaData:Index<BR /> FORMAT = pci</P> <P>props.conf<BR /> [host::x.x.x.x] <BR /> TRANSFORMS-rt1 = host_rename_rt1,index_redirect_to_pci</P> <P>Thanks</P> Mon, 28 Sep 2020 14:39:34 GMT paycorp 2020-09-28T14:39:34Z https://community.splunk.com/t5/Getting-Data-In/Redirection-to-different-index-using-transforms-conf/m-p/47188#M8966 <P>Hi,</P> <P>I have a couple of network devices which are sending logs to splunk over udp (so no forwarder installed on them).</P> <P>I'm struggling to get my transforms.conf to redirect the data to a separate index. <BR /> The network devices have 2 transforms rules, the first one being a MetaData:Host being set (instead of IP) which works fine. <BR /> What am I doing wrong for the index redirection? <BR /> Maybe some issue with SOURCE_KEY? I've tried using a SOURCE_KEY = MetaData:Host in transforms.conf</P> <P>transforms.conf<BR /> [host_rename_rt1]<BR /> REGEX = .<BR /> DEST_KEY = MetaData:Host<BR /> FORMAT = host::rt1</P> <P>[index_redirect_to_pci]<BR /> REGEX = .<BR /> DEST_KEY = MetaData:Index<BR /> FORMAT = pci</P> <P>props.conf<BR /> [host::x.x.x.x] <BR /> TRANSFORMS-rt1 = host_rename_rt1,index_redirect_to_pci</P> <P>Thanks</P> Mon, 28 Sep 2020 14:39:34 GMT https://community.splunk.com/t5/Getting-Data-In/Redirection-to-different-index-using-transforms-conf/m-p/47188#M8966 paycorp 2020-09-28T14:39:34Z https://community.splunk.com/t5/Getting-Data-In/Redirection-to-different-index-using-transforms-conf/m-p/47189#M8967 <P>You should have <CODE>_MetaData:Index</CODE> not <CODE>MetaData:Index</CODE>.</P> <PRE><CODE>### transforms.conf [host_rename_rt1] REGEX = . DEST_KEY = MetaData:Host FORMAT = host::rt1 [index_redirect_to_pci] REGEX = . DEST_KEY = _MetaData:Index FORMAT = pci ### props.conf [host::x.x.x.x] TRANSFORMS-rt1 = host_rename_rt1,index_redirect_to_pci </CODE></PRE> Tue, 27 Aug 2013 09:26:10 GMT https://community.splunk.com/t5/Getting-Data-In/Redirection-to-different-index-using-transforms-conf/m-p/47189#M8967 dart 2013-08-27T09:26:10Z