Getting Data In

How do I redirect to another indexer using wildcards in my props.conf?

daniel333
Builder

All,

I have the following props.conf / transforms.conf setup. Trying to set aside PCI into it's own set of indexers. However, redirection only works with a fully qualified hostname. Wildcards don't seem to work. Is there something I am missing?

transforms.conf

REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=pci-group

props.conf
doesn't work

[host::myvery.*]
TRANSFORMS-routing=pciRoutingbeta

doesn't work

[(?::){0}myvery*]
TRANSFORMS-routing=pciRoutingbeta

doesn't work

[(?::){0}myvery.*]
TRANSFORMS-routing=pciRoutingbeta

does work!

[host::myverylongservername]
TRANSFORMS-routing=pciRoutingbeta
0 Karma

lguinn2
Legend

I'm glad that you are figuring out the wildcards/regex for props.conf.

However, it would be easier - and more efficient - if you could do this routing at input time, instead during parsing.
You can specify the tcp routing in inputs.conf as well. It would look like this:

inputs.conf (on the hosts that you want to route in a special way)

[monitor:///therightfiles]
_TCP_ROUTING = pciRoutingbeta
0 Karma

sk314
Builder

did you try host::myvery*?

0 Karma

TStrauch
Communicator

try sk314´s way. this is explained in props.conf documentation.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...