Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Unable to send same source data to two different logical indexes and two different indexers groups.

$
0
0
Hi All, Facing few challlenges, mine is playing around with the same transforms. I'm trying to achieve the same source data to forward to two different logical indexes and two different indexers groups. Below is my senrio. In props.conf used [source::Dual_Data_Testing] TRANSFORMS-source = Stan1, Stan2 In transforms.conf [Stan1] SOURCE_KEY = MetaData:Source REGEX = . DEST_KEY = _MetaData:Index FORMAT = Index1 DEST_KEY = _TCP_ROUTING FORMAT = IndexerGroup1 [Stan2] SOURCE_KEY = MetaData:Source REGEX = . DEST_KEY = _MetaData:Index FORMAT = Index2 DEST_KEY = _TCP_ROUTING FORMAT = IndexerGroup2 Currently the above conf is not working. Please any suggestion can we workaround for this ? Thanks, Arun Sunny

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>