Deployment Architecture

How to reset the _TCP_ROUTING dest key


Please assume the below in transforms.conf

FORMAT = indexer1

REGEX = CEF\:0\|ids
FORMAT = nothing

REGEX = CEF\:0\|ids
FORMAT = syslog_group

The objective here is to send all event to the tcp out unless they match the regex CEF:0|ids in which case events should be sent to the syslog out.

What I can't sort out is how to reset the _TCP_ROUTING back to nothing in those events that are routed to syslog (since I don't want to have them duplicated).

Anyone has any idea here ?

Thanks !

(More details can be found here :

Labels (1)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.