Hello Community, We have 2 target groups to route events.(2 indexers, one is ours and other 3rd party) i want to configure Splunk HF to route events which does not contain particular keyword, ( like a NOT operation) to one target group and all events to other target group For example below should be my transforms.conf except that i am not sure about the Regex command. transforms.conf [specific_events] REGEX = "NOT ping" DEST_KEY = _TCP_ROUTING FORMAT = specific_event_targetgroup [all_events] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = all_event_targetgroup I have tried few Regex commands ^(?!.*ping).* and ^((?!ping).)*$ which worked in regex101 and splunk UI search but not in the conf files. Once i have applied these regex commands to conf file, no events were reaching indexers. Can someone help on this?
... View more