Please provide the REGEX pattern to extract from host and assign the value to index name, In the below example, we need to extract the value ABC and assign this to Index..
[generic_idx_routing]
SOURCE_KEY = MetaData:Host
REGEX = (ABC)\\.zxy\\.1a1\\.com
DEST_KEY = _MetaData:Index
FORMAT = $1
Are you trying to extract the first part of an hostname ?
host.domain.com -> host
host.subdomain.domain.com -> host
host -> host
host.com -> host
192.168.5.2 -> 192
please try
REGEX= ^([^\.]*)
Are you trying to extract the first part of an hostname ?
host.domain.com -> host
host.subdomain.domain.com -> host
host -> host
host.com -> host
192.168.5.2 -> 192
please try
REGEX= ^([^\.]*)
Have a look at the similar question.
http://answers.splunk.com/answers/1026/route-data-to-index-based-on-host