Getting Data In

Deleting datas on one index after routing them to another index

Nicolas2203
Path Finder

Hello,
My use case :

Context : On azure, datas from several applications are pushed in a Azure EventHub

I need to separate the datas from one application, and put this datas into a new index on Splunk

On Azure, all the resources of this app are in one Ressource Group : TheAppResourceGroupName

I used a Heavy Forwarder, and this are my configs :

props.conf :
[source::eventhub://EVENTHUBAZURE.servicebus.windows.net/app-logs;]
TRANSFORMS-route =  routeToNewIndex, discard_original,

transforms.conf
[routeToNewIndex]
REGEX = TheAppResourceGroupName
DEST_KEY = _MetaData:Index
FORMAT = NewIndex


[discard_original]
REGEX = TheAppResourceGroupName
DEST_KEY = queue
FORMAT = nullQueue

This config will delete the datas, yes, but in the NewIndex, and not in the original Index, after the routing.

I didn't find an answer witch fit with my needs on the commu and the docs, but maybe someone has to face a similar need .

Thanks a lot for the help!

Nico

Labels (1)
0 Karma

Nicolas2203
Path Finder

Hello @livehybrid , yes, data are still getting in the original index and they contain "TheAppResourceGroupName"

 

0 Karma

livehybrid
Super Champion

Hi @Nicolas2203 

Are you still seeing data containing "TheAppResourceGroupName" in the original index name?

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...