Hi @Abha111 , Will the host name parameter come inside the events as well? If yes. you can simply define a regex in transforms.conf to route it to specific index. Example below. props.conf [your_sourcetype] enter your props TRANSFORMS-routing=set_nonprod,setprod transforms.conf [set_nonprod] REGEX = abc-nprd* DEST_KEY = _MetaData:Index FORMAT = index_x [setprod] REGEX = abc-prd* DEST_KEY = _MetaData:Index FORMAT = index_y Try this. Let me know for any further questions. If this works, give thumbs-up 🙂 Happy Splunking!!  ... View more

Hi @paoloromagnoli, try this | rest splunk_server=local /services/deployment/server/clients | table hostname ip utsname *.restartSplunkd | eval temp=hostname."#".ip."#".utsname | table temp *.restartSplunkd | eval application.NoApp.restartSplunkd=0 | untable temp apps count | eval Apps=if(like(apps,"app%"),mvindex(split(apps,"."),1),null()) | eval ServerClass=if(like(apps,"server%"),mvindex(split(apps,"."),1),null() ) | rex field=temp "(?<Host>.*)#(?<Host_IP>.*)#(?<Machine_Type>.*)" | table Host Host_IP Machine_Type Apps ServerClass | stats Values(*) as * dc(Apps) AS dc_apps by Host Host_IP Machine_Type | eval Apps=if(dc_apps=1,Apps,mvindex(Apps,1,10)) | nomv Apps | nomv ServerClass | fillnull value="NoSC" ServerClass Ciao. Giuseppe ... View more