We are, unfortunately, having to change index names to match a naming convention. I have a list of indexes that need to be "renamed" ... for routing to the new indexes, rather than track down all the configs which are managed with DS, chef, and other tools, I would like use props\transforms on the HWF's and IDX's to look at every event, and if it was destined for index foo, send it to index foo.
Here is what I have on a single Splunk instance, in system/local (for simplicity and testing the config):
props:
[default]
TRANSFORMS-foo_idx_rename= foo_idx_rename
transforms:
[foo_idx_rename]
SOURCE_KEY = MetaData:Index
REGEX = (foo)
DEST_KEY = _MetaData:Index
FORMAT = bar
I've tried:
REGEX = foo
REGEX = "foo"
REGEX = "*foo*"
REGEX = index::foo
Nothing I've tried seems to work.
Questions I have:
What is the actual value that the regex needs to evaluate for the index metadata field? (ie- index::foo or just foo)
Are double quotes required in the regex? Must there be ()'s?
I've seen a couple examples that say they work, but when I copy them verbatim, they do not.
