I´m trying to clone events that originate from splunk connector for kubernetes using the following configuration in props.conf and transforms.conf:
[(?::){0}*]
TRANSFORMS-logs_java=clone_trace
[trace]
TRANSFORMS-indice=indice_trace
tranforms.conf
[clone_trace]
REGEX=.
CLONE_SOURCETYPE=trace
[indice_trace]
REGEX=.
DEST_KEY=_MetaData:Index
FORMAT=jaeger_trace
For some reason some events are not beeing cloned.
Any ideas?
