https://community.splunk.com/t5/Getting-Data-In/Changing-the-Default-Index-per-Host/m-p/12958#M1114 <P>Is it possible to somehow configure the "default" index on a per-host basis? We have several lightweight forwarders and are having to go in and manually edit the index to point to a custom index for each input. Surely there's a way to do it once and have it work everywhere?</P> Thu, 06 May 2010 02:30:44 GMT AthlonRob 2010-05-06T02:30:44Z https://community.splunk.com/t5/Getting-Data-In/Changing-the-Default-Index-per-Host/m-p/12958#M1114 <P>Is it possible to somehow configure the "default" index on a per-host basis? We have several lightweight forwarders and are having to go in and manually edit the index to point to a custom index for each input. Surely there's a way to do it once and have it work everywhere?</P> Thu, 06 May 2010 02:30:44 GMT https://community.splunk.com/t5/Getting-Data-In/Changing-the-Default-Index-per-Host/m-p/12958#M1114 AthlonRob 2010-05-06T02:30:44Z https://community.splunk.com/t5/Getting-Data-In/Changing-the-Default-Index-per-Host/m-p/12959#M1115 <P>Yes. You can just add</P> <PRE><CODE>[default] index = newindex </CODE></PRE> <P>to the top of inputs.conf (probably <CODE>$SPLUNK_HOME/etc/system/local/inputs.conf</CODE>, but any one should work)</P> Thu, 06 May 2010 02:58:59 GMT https://community.splunk.com/t5/Getting-Data-In/Changing-the-Default-Index-per-Host/m-p/12959#M1115 gkanapathy 2010-05-06T02:58:59Z