hi Hunter,
Thx for your answer but i still can't.
this my transforms.conf
[route_top1]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = os
[route_top2]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = apaaja
i think my regex should be the same one and another, because the data that i want to get into Splunk is data from "Top" command in linux. So i'm still confusing why Splunk only get the data into the "apaaja" index instead two both of the index that i made. it's look like the transfroms only replace the original index from inputs.conf which is index=os.
... View more