Why is the data not being filtered to another index?

[Yaichael]

I have the following configuration for filtering the data coming from X udp port data input to an index that's being already created:

props.conf

[source::udp:X]
TRANSFORMS-new_index= route_index

transforms.conf

[route_index]
REGEX = ^"ip_add"$

DEST_KEY = _MetaData:Index

FORMAT = new_index

I know I'm almost there, but why it isn't working how it is supposed to?

Thanks!

[Yaichael · Accepted solution]

I changed the configuration as follows, and it worked:

props.conf

[host::host_ip]
TRANSFORMS-new_index = route_index

transforms.conf

[route_index]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = new_index

Thanks for the help everyone!

[s2_splunk]

That will apply to everything (matching on .). Your question suggested you wanted to only route events that start with an IP address/the string "ip_add". If matching everything is what you need, cool.

[MuS]

It will match everything from host host_ip so this solution also only applies to one host; like the regex approach 🙂

[somesoni2]

Try escaping the double quotes on the REGEX with backslash. ALso. ensuer the configurations are there in the Heavy forwarder/Indexer which comes first and your restart SPlunk after the change.

[Yaichael]

In the REGEX, the ip address isn't surrounded by double quotes. I wrote it like that so the system could see my input.

Sorry for not commenting the details.

[somesoni2]

Ok. I'm guessing you're using proper regex for ip address (\d+\.\d+\.\d+\.\d+) then just the literal in the
REGEX = ^ip_add$. So, does you event only contains the ip address, as you're mentioned that line 1 in your events starts and ends with ip address? That may have bee causing it to fail.

If your event starts with ip address, use this as filter REGEX = ^\d+\.\d+\.\d+\.\d+
If your event ending with ip address, use this as filter REGEX = \d+\.\d+\.\d+\.\d+$

[s2_splunk]

Without seeing a sample event it will be tricky to validate that your RegEx will actually match incoming data.
Can you share a sample?

Your other settings look correct to me.