[trackme_dsm_hybrid_root_constraint_tracker-lj1rhqp_tenant_1]
definition = (index=*) (splunk_server=*) (sourcetype!=stash sourcetype!=*too_small sourcetype!=modular_alerts:trackme* sourcetype!=trackme:*)