Getting Data In

transforms.conf

VijaySrrie
Builder

Please help me with the transforms.conf

Available indexes details

index_pr_prod

index_ee_psvt

index_np_psup

 

Index has 3 parts, 1st part is same , 2nd part we need to derive from host and 3rd part we need to derive from asset_env

I tried the below transforms but it did not work, do we need two different stanza configs in transforms.com?

[change_index_name]
SOURCE_KEY = MetaData:Host
REGEX = ^host::\w{12}(?i)(ee|pr|ps)
DEST_KEY = _MetaData:Index
SOURCE_KEY = MetaData:Asset_Env
REGEX = ^asset_env::\w{5}
DEST_KEY = _MetaData:Index
FORMAT = index_$1_$2

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @VijaySrrie,

you cannot put in the same stanza more times the same option, only once; so you have to find one single regex to identify the three groups in index names.

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...