Before I ask my question, this is my environment.
1 search head
I am trying to setup several indexes (based on source types).
I have created indexes on each of the indexers (ct_usertransaction), and setup rules according to the documentation.
props.conf (on forwarder) [ct-UserTransaction] TRANSFORMS-index = ct-UserTransaction [ct-UserTransaction] DEST_KEY = MetaData:Index REGEX = (ct-UserTransaction:) FORMAT = ct_usertransaction
But I don't see anything in ct_usertransaction index.
Where do I need to configure the rules, on a forwarder or indexers?