Can you please tell us, how to assign a common index name for all splunktcp inputs at indexer side?
Trying but this seems to be not working if some of the source doesn't have path or less a than 3 directory structure.
props.conf
[source::...]
TRANSFORMS-idx_routing = generic_idx_routing
transforms.conf
[generic_idx_routing]
REGEX =.*
DEST_KEY = _MetaData:Index
FORMAT = cmstest1
↧
