Hello,
We have two clustered Splunk platforms.
Several sources are sent to both platforms (directly to clustered indexers) as index app-idx1, then on 2nd platform we use different target index name using props.conf/transforms.conf to have application_idx2
For unknown reason few sources are failing to lastchanceindex.
props.conf
[source::/path/to/app_json.log]
TRANSFORMS-app-idx1 = set_idx1_index
transforms.conf
[set_idx1_index]
SOURCE_KEY = _MetaData:Index
REGEX = app-idx1
DEST_KEY = _MetaData:Index
FORMAT = application_idx2
Thanks for your help.
To troubleshoot your sources failing to lastchanceindex, I recommend checking if your REGEX pattern is too strict.
If this helps, Please Upvote.