How do I redirect to another indexer using wildcards in my props.conf?

[daniel333]

All,

I have the following props.conf / transforms.conf setup. Trying to set aside PCI into it's own set of indexers. However, redirection only works with a fully qualified hostname. Wildcards don't seem to work. Is there something I am missing?

transforms.conf

REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=pci-group

props.conf
doesn't work

[host::myvery.*]
TRANSFORMS-routing=pciRoutingbeta

doesn't work

[(?::){0}myvery*]
TRANSFORMS-routing=pciRoutingbeta

doesn't work

[(?::){0}myvery.*]
TRANSFORMS-routing=pciRoutingbeta

does work!

[host::myverylongservername]
TRANSFORMS-routing=pciRoutingbeta

[lguinn2]

I'm glad that you are figuring out the wildcards/regex for props.conf.

However, it would be easier - and more efficient - if you could do this routing at input time, instead during parsing.
You can specify the tcp routing in inputs.conf as well. It would look like this:

inputs.conf (on the hosts that you want to route in a special way)

[monitor:///therightfiles]
_TCP_ROUTING = pciRoutingbeta

[sk314]

did you try host::myvery*?

[TStrauch]

try sk314´s way. this is explained in props.conf documentation.