We were able to get everything working in the end! Not sure what the exact problem was but the regex was invalid, we used regex101 with the  python flavor to fix and build our regex. ... View more

Hi! I followed your advice to setup a Heavy Forwarder and installed the Splunk Add-on for Google Cloud Platform. Then, I configured it to forward logs to Splunk Cloud. I configured props.conf like in the original answer (on the HF) and can verify in the GUI that the changes has applied but the logs that are forwarded to SC have not been transformed / de-nested. I don't know where the problem lies. Question 1: Should the source type in props.conf be [google:gcp:pubsub:message] ? Question 2: Should props.conf be configured on the HF or SC? Question 3: Since I realised I can make this configuration in the GUI (on SC or IDM would work?), do I even need the HF? HF config: Logs on SC: ... View more

Hi @kamlesh_vaghela, I also want to de-nest logs that have been pulled from GCP. have Splunk Cloud and as far as I know, I can't edit props.conf, is it possible to achieve this using the GUI in "Field transformations"? ... View more

Hi, @mohammadsharukh @Ksr1982  I found the following information here:  https://cloud.google.com/architecture/deploying-production-ready-log-exports-to-splunk-using-dataflow#deploy_the_dataflow_pipeline "YOUR_SPLUNK_HEC_URL must not include the HEC endpoint path, for example, /services/collector. Splunk Dataflow template currently only supports /services/collector endpoint for JSON-formatted events, and it automatically appends that path to your Splunk HEC URL input." ... View more