Deleting datas on one index after routing them to another index

[Nicolas2203]

Hello,
My use case :

Context : On azure, datas from several applications are pushed in a Azure EventHub

I need to separate the datas from one application, and put this datas into a new index on Splunk

On Azure, all the resources of this app are in one Ressource Group : TheAppResourceGroupName

I used a Heavy Forwarder, and this are my configs :

props.conf :
[source::eventhub://EVENTHUBAZURE.servicebus.windows.net/app-logs;]
TRANSFORMS-route =  routeToNewIndex, discard_original,

transforms.conf
[routeToNewIndex]
REGEX = TheAppResourceGroupName
DEST_KEY = _MetaData:Index
FORMAT = NewIndex

[discard_original]
REGEX = TheAppResourceGroupName
DEST_KEY = queue
FORMAT = nullQueue

This config will delete the datas, yes, but in the NewIndex, and not in the original Index, after the routing.

I didn't find an answer witch fit with my needs on the commu and the docs, but maybe someone has to face a similar need .

Thanks a lot for the help!

Nico

[Nicolas2203]

Hello @livehybrid , yes, data are still getting in the original index and they contain "TheAppResourceGroupName"

[livehybrid]

Hi @Nicolas2203 

Are you still seeing data containing "TheAppResourceGroupName" in the original index name?