Getting Data In

Deleting datas on one index after routing them to another index

Nicolas2203
Path Finder

Hello,
My use case :

Context : On azure, datas from several applications are pushed in a Azure EventHub

I need to separate the datas from one application, and put this datas into a new index on Splunk

On Azure, all the resources of this app are in one Ressource Group : TheAppResourceGroupName

I used a Heavy Forwarder, and this are my configs :

props.conf :
[source::eventhub://EVENTHUBAZURE.servicebus.windows.net/app-logs;]
TRANSFORMS-route =  routeToNewIndex, discard_original,

transforms.conf
[routeToNewIndex]
REGEX = TheAppResourceGroupName
DEST_KEY = _MetaData:Index
FORMAT = NewIndex


[discard_original]
REGEX = TheAppResourceGroupName
DEST_KEY = queue
FORMAT = nullQueue

This config will delete the datas, yes, but in the NewIndex, and not in the original Index, after the routing.

I didn't find an answer witch fit with my needs on the commu and the docs, but maybe someone has to face a similar need .

Thanks a lot for the help!

Nico

Labels (1)
0 Karma

Nicolas2203
Path Finder

Hello @livehybrid , yes, data are still getting in the original index and they contain "TheAppResourceGroupName"

 

0 Karma

livehybrid
Super Champion

Hi @Nicolas2203 

Are you still seeing data containing "TheAppResourceGroupName" in the original index name?

 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...