I have the following configuration for filtering the data coming from X udp port data input to an index that's being already created:
props.conf
[source::udp:X]
TRANSFORMS-new_index= route_index
transforms.conf
[route_index]
REGEX = ^"ip_add"$
DEST_KEY = _MetaData:Index
FORMAT = new_index
I know I'm almost there, but why it isn't working how it is supposed to?
Thanks!
I changed the configuration as follows, and it worked:
props.conf
[host::host_ip]
TRANSFORMS-new_index = route_index
transforms.conf
[route_index]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = new_index
Thanks for the help everyone!
I changed the configuration as follows, and it worked:
props.conf
[host::host_ip]
TRANSFORMS-new_index = route_index
transforms.conf
[route_index]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = new_index
Thanks for the help everyone!
That will apply to everything (matching on .). Your question suggested you wanted to only route events that start with an IP address/the string "ip_add". If matching everything is what you need, cool.
It will match everything from host host_ip
so this solution also only applies to one host; like the regex approach 🙂
Try escaping the double quotes on the REGEX with backslash. ALso. ensuer the configurations are there in the Heavy forwarder/Indexer which comes first and your restart SPlunk after the change.
In the REGEX, the ip address isn't surrounded by double quotes. I wrote it like that so the system could see my input.
Sorry for not commenting the details.
Ok. I'm guessing you're using proper regex for ip address (\d+\.\d+\.\d+\.\d+
) then just the literal in the
REGEX = ^ip_add$. So, does you event only contains the ip address, as you're mentioned that line 1 in your events starts and ends with ip address? That may have bee causing it to fail.
If your event starts with ip address, use this as filter REGEX = ^\d+\.\d+\.\d+\.\d+
If your event ending with ip address, use this as filter REGEX = \d+\.\d+\.\d+\.\d+$
Without seeing a sample event it will be tricky to validate that your RegEx will actually match incoming data.
Can you share a sample?
Your other settings look correct to me.