This solution worked until I needed to add more indexes to the VPC. Since the host have multiple indexes I've changed the files to go by source and am trying to indicate the prefix of the hostnames in the transforms REGEX section. My current problem and set-up is, VPC Name Hostnames Prefix per VPC Inputs Indexes vpcX ab- Linux and Windows os, windows, wineventlog, msad, perfmon vpcY cd- Linux and Windows os_cd, windows_cd, wineventlog_cd, msad_cd, perfmon_cd vpcZ ef- Linux and Windowws os_ef, windows_ef, wineventlog_ef, msad_ef, perfmon_ef My current props.conf for Splunk_TA_nix is, [source::/var/*]
TRANSFORMS-routing = osCd
TRANSFORMS-routing = osEf
[source::/etc/*]
TRANSFORMS-routing = osCd
TRANSFORMS-routing = osEf
[source::Linux*]
TRANSFORMS-routing = osCd
TRANSFORMS-routing = osEf
(etc. I've added every source found in the Splunk_TA_nix add-on) and transforms.conf is where the REGEX is referencing the hostname prefix, [osCd]
SOURCE_KEY = MetaData:Source
REGEX = .+cd.+
DEST_KEY = _MetaData:Index
FORMAT = os_cd
[osEf]
SOURCE_KEY = MetaData:Source
REGEX = .+ef.+
DEST_KEY = _MetaData:Index
FORMAT = os_ef Am I writing the REGEX correctly to search on the hostname in addition to the source that is referenced in props.conf? Or is there another parameter/method to specify this?
... View more