https://community.splunk.com/t5/Getting-Data-In/transforms-conf-use-two-conditions/m-p/475521#M99741 <P>I have an event in index xxx with events coming from different hosts.<BR /> I need to create a transforms.conf to filter when the event has a specific word than I route for another index.</P> <P>transforms.conf <BR /> [abc]<BR /> REGEX = debug<BR /> DEST_KEY = _MetaData:Index<BR /> FORMAT = debug</P> <P>That config works well to filter the word and send it to the correct index, but I need to send for this index only words for specifics hosts.<BR /> Like that:<BR /> If I have debug AND host=this_host send to index debug.<BR /> How I can do that?</P> Tue, 05 Nov 2019 09:58:39 GMT rex_rafa 2019-11-05T09:58:39Z https://community.splunk.com/t5/Getting-Data-In/transforms-conf-use-two-conditions/m-p/475521#M99741 <P>I have an event in index xxx with events coming from different hosts.<BR /> I need to create a transforms.conf to filter when the event has a specific word than I route for another index.</P> <P>transforms.conf <BR /> [abc]<BR /> REGEX = debug<BR /> DEST_KEY = _MetaData:Index<BR /> FORMAT = debug</P> <P>That config works well to filter the word and send it to the correct index, but I need to send for this index only words for specifics hosts.<BR /> Like that:<BR /> If I have debug AND host=this_host send to index debug.<BR /> How I can do that?</P> Tue, 05 Nov 2019 09:58:39 GMT https://community.splunk.com/t5/Getting-Data-In/transforms-conf-use-two-conditions/m-p/475521#M99741 rex_rafa 2019-11-05T09:58:39Z https://community.splunk.com/t5/Getting-Data-In/transforms-conf-use-two-conditions/m-p/475522#M99742 <P>Have you tried the MetaData::Host key? </P> <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf?utm_source=answers&amp;utm_medium=in-question&amp;utm_term=transforms.conf&amp;utm_campaign=refdoc#KEYS:">https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf?utm_source=answers&amp;utm_medium=in-question&amp;utm_term=transforms.conf&amp;utm_campaign=refdoc#KEYS:</A></P> Tue, 05 Nov 2019 17:29:23 GMT https://community.splunk.com/t5/Getting-Data-In/transforms-conf-use-two-conditions/m-p/475522#M99742 marycordova 2019-11-05T17:29:23Z