I am trying to create a stanza in props.conf so that all non splunk internal logs go to index=newindex.
I tried using negative lookahead as follow:
[source::^(?!.*log\/*\\*splunk).*$]
But it doesn't work.
Thanks.
↧