Problems cloning events

Getting Data In

I´m trying to clone events that originate from splunk connector for kubernetes using the following configuration in props.conf and transforms.conf:

[(?::){0}*]
TRANSFORMS-logs_java=clone_trace

[trace]
TRANSFORMS-indice=indice_trace

tranforms.conf

[clone_trace]
REGEX=.
CLONE_SOURCETYPE=trace

[indice_trace]
REGEX=.
DEST_KEY=_MetaData:Index
FORMAT=jaeger_trace

For some reason some events are not beeing cloned.

Any ideas?

Get Updates on the Splunk Community!

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl. To make life better, use an ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...

Join the Conversation