Routing events on UF for sourcetypes with INDEXED_EXTRACTIONS set

[hrawat]

Can we apply following example on UF?

Keep specific events and discard the rest

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_eve...


The answer is no. The example is for any non-UF instance.
For UF you can modify the example

Edit props.conf and add the following:

[source::/var/log/messages]
TRANSFORMS-set= setnull,setparsing

Edit transforms.conf and add the following:

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = \[sshd\]
DEST_KEY = _TCP_ROUTING
FORMAT = <valid-tcpoutgroup(s)>

Or

Edit props.conf and add the following:

[source::/var/log/messages]
TRANSFORMS-set= setnull,setparsing

Edit transforms.conf and add the following:

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = \[sshd\]
DEST_KEY = queue
FORMAT = parsingQueue