https://community.splunk.com/t5/Getting-Data-In/Change-Universal-Forwarder-index/m-p/28998#M4998 <P>I'm trying to change were universal forwarders information gets indexed.</P> <P>Example:</P> <P>Universal forwarder configured to send data to splunkserver:2222</P> <P>On the Splunk server in my /etc/system/local/inputs.conf I have:</P> <P>[splunktcp://2222]<BR /> index = notmain</P> <P>However all the forwarded data goes into the main index.<BR /> Thanks</P> Mon, 05 Dec 2011 22:09:18 GMT hgclowns 2011-12-05T22:09:18Z https://community.splunk.com/t5/Getting-Data-In/Change-Universal-Forwarder-index/m-p/28998#M4998 <P>I'm trying to change were universal forwarders information gets indexed.</P> <P>Example:</P> <P>Universal forwarder configured to send data to splunkserver:2222</P> <P>On the Splunk server in my /etc/system/local/inputs.conf I have:</P> <P>[splunktcp://2222]<BR /> index = notmain</P> <P>However all the forwarded data goes into the main index.<BR /> Thanks</P> Mon, 05 Dec 2011 22:09:18 GMT https://community.splunk.com/t5/Getting-Data-In/Change-Universal-Forwarder-index/m-p/28998#M4998 hgclowns 2011-12-05T22:09:18Z https://community.splunk.com/t5/Getting-Data-In/Change-Universal-Forwarder-index/m-p/28999#M4999 <P>Adding index=notmain on the universal forwarder /etc/system/local/inputs.conf did the trick</P> Mon, 05 Dec 2011 23:14:18 GMT https://community.splunk.com/t5/Getting-Data-In/Change-Universal-Forwarder-index/m-p/28999#M4999 hgclowns 2011-12-05T23:14:18Z