I am routing traffic to a 3rd party. I have done some of this based on a host and others based on the source type.
But I now need to route based on a host and a sourcetype and I can't work out how to do it?
Any tips of where to look?
I think you could do something along these lines, triggering the transforms based on sourcetype, but inside the transforms config filter by host using the REGEX.
TRANSFORMS-setrouting = your-routing
SOURCE_KEY = MetaData:Host
REGEX = (host1|host2|...|hostn)
DEST_KEY = _TCP_ROUTING
FORMAT = your-outputgroup
View solution in original post
Cheers mate I came to that solution too. Just double checking if there was another way.