@Jeremy Dyer I understand how a global replacement works, but am struggling when I just want to replace certain occurrences. Let's say my Flowfile looks like this: xyz key=AABBBBCC foo bar AABBBBCC Another one looks like this: xyz key=DDEEEEFF foo bar DDEEEEFF I only want to replace the values that are prepended by key= I tried with Regular Expression key=(\S+) and Matching Group 1 , which didn't work. What did work was setting the Regex to key=(AABBBBCC|DDEEEEFF), but this unfortunately makes the regex static. ... View more

@Alex K IMHO the best way, to send data to Splunk is through the HTTP Event Collector. I'm using the AttributeToJSON processor to create a JSON file with an Attribute List of host, sourcetype, source, event The JSON file is then sent to HEC using the InvokeHTTP processor. Works like a charm 🙂 ... View more