TCP routing and change target index on secondary Splunk platform

[splunkreal]

Hello,

We have two clustered Splunk platforms.

Several sources are sent to both platforms (directly to clustered indexers) as index app-idx1, then on 2nd platform we use different target index name using props.conf/transforms.conf to have application_idx2

For unknown reason few sources are failing to lastchanceindex.

props.conf

[source::/path/to/app_json.log]

TRANSFORMS-app-idx1 = set_idx1_index

 

transforms.conf

[set_idx1_index]

SOURCE_KEY = _MetaData:Index

REGEX = app-idx1

DEST_KEY = _MetaData:Index

FORMAT = application_idx2

Thanks for your help.

[sainag_splunk]

To troubleshoot your sources failing to lastchanceindex, I recommend checking if your REGEX pattern is too strict.






If this helps, Please Upvote.