Hello Splunkers,
Please I would like to know if it is possible, at indexer layer, given a HEC input source, to route some incoming data (of course based on regex) to a UDP destination without indexing that data.
Let's say: sourcetype=hecinput, if it contains word "DEBUG" it should go to UDP destination, all the rest should be indexed as usual.
- I know that maybe I could use INGEST_EVAL, but I think it supports only _TCP_ROUTING.
Thanks in advance.
