Hello everyone I'm fairly familiar with routing data based on the logs themselves, however, I was wondering if there was a way to call an external mapping table in the transfoms.conf file. Logs would contain one identifiable serial number Firewall 1 with serial number xxxxxxxxxxxx Firewall 2 with serial number yyyyyyyyyyyy Firewall 3 with serial number zzzzzzzzzzzz And we would like to send each log to a different indexer depending on that serial number. Serial numbers are included in the logs and we have a mapping table that looks like this: serial number indexer xxxxxxxxxxxx indexer 1 yyyyyyyyyyyy indexer 2 zzzzzzzzzzzz indexer 3 and so on... The only way I see right now is to create one manual entry in the props and transform files and I was wondering if there was a way to call an external mapping table, that way, whenever a new firewall comes into play, we would only need to update the table and not props and transforms files. Thank you
... View more