Hi,
We need to route os data from one set of indexers to another set of indexers,but while using the below settings all the data from our indexers are getting routed to other set of indexers (testServers).
=======Transforms.conf======
[fleet]
REGEX = .
DEST_KEY=_TCP_ROUTING
FORMAT=testServers
=======Props.conf======
[top]
TRANSFORMS-routing=fleet
[iostat]
TRANSFORMS-routing=fleet
[vmstat]
TRANSFORMS-routing=fleet
[interfaces]
TRANSFORMS-routing=fleet
[cpu]
TRANSFORMS-routing=fleet
[df]
TRANSFORMS-routing=fleet
[hardware]
TRANSFORMS-routing=fleet
[version]
TRANSFORMS-routing=fleet
=======Outputs.conf======
[tcpout:testServers]
server= testServer.com:9997
We are routing the os data coming from our universal forwarders, using heavy forwarders. But here we need to route the os data of our indexers to another set of indexers. The above settings is not working in this case.
Any help is appreciated.
Thanks
↧