How use the transform.conf to filter event value and Host

[rex_rafa]

I have an index receiving events from some hosts, I create a new index and need to send for this new index data that contains the work debug, I create this rule bellow and work.

[ABC]
REGEX = debug
DEST_KEY = _MetaData:Index
FORMAT = debug

The problem is I need to send this event to new index only it has the word debug and specific hosts.
If debug and host=xxx send for index debug if have only debug still sending for the old index.

[rex_rafa]

I use that and work, but I don't know why, but some events sting going for the other index, In 20 events 18 went to correct index and 2 for the wrong index.
I cant understand why it's happening,

[gcusello · Accepted solution]

Hi rex_rafa,
you could try to use your transformation for the hosts to filter, in other words:
in props.conf:

[host::xxx]
TRANSFORMS-override_index=override_index

In transforms.conf:

[override_index]
REGEX = debug
DEST_KEY = _MetaData:Index
FORMAT = debug

Ciao.
Giuseppe

[gcusello]

Hi rex_rafa,
check the regex, usually this is the problem.
Then check the hostname.

Ciao.
Giuseppe

[rex_rafa]

Do you know if have any way to see the logs of this transforms.conf?
Because If I get the events and use the https://regexr.com/ to validate the regex, the regex is correct.
The host is correct too, but is strange, because just few events are going to the wrong index.

[gcusello]

Hi rex_rafa,
About the regex check you can do it also in Splunk Search App using the regex command, sometimes, there''s something different.

Anyway, did you checked regex and host values at the same time?
you could use something like this:
| index=wrong_index
| regex "debug"
| table _time host _raw
In this way you can check if events with "debug" have the correct host value or a different one.

Ciao.
Giuseppe