Getting Data In

transforms.conf use two conditions

rex_rafa
New Member

I have an event in index xxx with events coming from different hosts.
I need to create a transforms.conf to filter when the event has a specific word than I route for another index.

transforms.conf
[abc]
REGEX = debug
DEST_KEY = _MetaData:Index
FORMAT = debug

That config works well to filter the word and send it to the correct index, but I need to send for this index only words for specifics hosts.
Like that:
If I have debug AND host=this_host send to index debug.
How I can do that?

Tags (1)
0 Karma

marycordova
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...