Can someone please help here ?
I do not want to send the logs to Indexers and i have called only vesxi in my transforms.conf as target server but still Splunk heavyforwarder is sending the logs Indexer(10.1.1.1:9996 and 10.1.1.2:9997)
outputs.conf
[tcpout:Indexers]
server = 10.1.1.1:9996,10.1.1.2:9997
[tcpout:vesxi]
server = 10.20.20.20:519
sendCookedData = false
disabled = false
Transforms.conf
[vmwaresxilogs]
REGEX = (logged out|Rejected password for user|Cannot login|logged in as|Accepted user for user|was updated on host|Password was changed for account|Destroy VM called)
DEST_KEY = _TCP_ROUTING
FORMAT = vesxi
props.conf
[vmw-syslog]
TRANSFORMS-routing=vmwaresxilogs
