https://community.splunk.com/t5/Getting-Data-In/Perfmon-sending-logs-to-the-wrong-indexer/m-p/499867#M85800 <P>I was able to find that there was an application called Splunk TA (splunkuniversalforwarder/etc/apps) which resided on that machine simply deleted it because I know I do not have this on my fresh install of Splunk so it won't be pushed out again also checked my deployment server and made sure it is none existent there.</P> Fri, 15 May 2020 21:28:38 GMT splunktrainingu 2020-05-15T21:28:38Z https://community.splunk.com/t5/Getting-Data-In/Perfmon-sending-logs-to-the-wrong-indexer/m-p/499866#M85799 <P>I have a single instance deployment. I have a server that is sending Perfmon logs to my main index but I never told it to send those logs. Where do I check those settings? I want to keep it sending logs but to the correct index. So I made a perfmon index but I cannot find where on the server this configuration files is. I checked etc/system/local couldn't find anything.</P> Fri, 05 Jun 2020 23:58:09 GMT https://community.splunk.com/t5/Getting-Data-In/Perfmon-sending-logs-to-the-wrong-indexer/m-p/499866#M85799 splunktrainingu 2020-06-05T23:58:09Z https://community.splunk.com/t5/Getting-Data-In/Perfmon-sending-logs-to-the-wrong-indexer/m-p/499867#M85800 <P>I was able to find that there was an application called Splunk TA (splunkuniversalforwarder/etc/apps) which resided on that machine simply deleted it because I know I do not have this on my fresh install of Splunk so it won't be pushed out again also checked my deployment server and made sure it is none existent there.</P> Fri, 15 May 2020 21:28:38 GMT https://community.splunk.com/t5/Getting-Data-In/Perfmon-sending-logs-to-the-wrong-indexer/m-p/499867#M85800 splunktrainingu 2020-05-15T21:28:38Z