Problems cloning events

Getting Data In

I´m trying to clone events that originate from splunk connector for kubernetes using the following configuration in props.conf and transforms.conf:

[(?::){0}*]
TRANSFORMS-logs_java=clone_trace

[trace]
TRANSFORMS-indice=indice_trace

tranforms.conf

[clone_trace]
REGEX=.
CLONE_SOURCETYPE=trace

[indice_trace]
REGEX=.
DEST_KEY=_MetaData:Index
FORMAT=jaeger_trace

For some reason some events are not beeing cloned.

Any ideas?

Get Updates on the Splunk Community!

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...