Hello,
My use case :
Context : On azure, datas from several applications are pushed in a Azure EventHub
I need to separate the datas from one application, and put this datas into a new index on Splunk
On Azure, all the resources of this app are in one Ressource Group : TheAppResourceGroupName
I used a Heavy Forwarder, and this are my configs :
props.conf :
[source::eventhub://EVENTHUBAZURE.servicebus.windows.net/app-logs;]
TRANSFORMS-route = routeToNewIndex, discard_original,
transforms.conf
[routeToNewIndex]
REGEX = TheAppResourceGroupName
DEST_KEY = _MetaData:Index
FORMAT = NewIndex
[discard_original]
REGEX = TheAppResourceGroupName
DEST_KEY = queue
FORMAT = nullQueue
This config will delete the datas, yes, but in the NewIndex, and not in the original Index, after the routing.
I didn't find an answer witch fit with my needs on the commu and the docs, but maybe someone has to face a similar need .
Thanks a lot for the help!
Nico
Hello @livehybrid , yes, data are still getting in the original index and they contain "TheAppResourceGroupName"
Hi @Nicolas2203
Are you still seeing data containing "TheAppResourceGroupName" in the original index name?