https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-a-custom-index-which-is-currently-being-sent/m-p/456101#M99429 <P>Hello @amulay26 - may be there is one more inputs.conf in some other app or system local in your splunk enterprise.<BR /> with below command please find it.</P> <P>/opt/splunk/bin/splunk cmd btool inputs list --debug | grep index</P> <P>you will get all the inputs.conf files splunk is using in you environment .</P> Mon, 19 Aug 2019 04:19:26 GMT Mayurmpatil 2019-08-19T04:19:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-a-custom-index-which-is-currently-being-sent/m-p/456100#M99428 <P>Am trying to solve a problem here. The inputs.conf for one of the monitoring stanza on the forwarder had index = main . I changed the inputs.conf on Deployment server and defined index = a and enabled restart splunkd. Am able to see an updated inputs.conf with index = a under the monitoring stanza. However, when I do a btool, I still see index = main for the same monitoring stanza.</P> <P>How do I send data to index = a instead of index = main?</P> <P>Any help will be appreciated. Thanks. </P> Mon, 19 Aug 2019 01:54:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-a-custom-index-which-is-currently-being-sent/m-p/456100#M99428 amulay26 2019-08-19T01:54:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-a-custom-index-which-is-currently-being-sent/m-p/456101#M99429 <P>Hello @amulay26 - may be there is one more inputs.conf in some other app or system local in your splunk enterprise.<BR /> with below command please find it.</P> <P>/opt/splunk/bin/splunk cmd btool inputs list --debug | grep index</P> <P>you will get all the inputs.conf files splunk is using in you environment .</P> Mon, 19 Aug 2019 04:19:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-a-custom-index-which-is-currently-being-sent/m-p/456101#M99429 Mayurmpatil 2019-08-19T04:19:26Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-a-custom-index-which-is-currently-being-sent/m-p/456102#M99430 <P>I did a btool as well. There is no alternate inputs.conf on the Forwarder.</P> Mon, 19 Aug 2019 13:20:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-a-custom-index-which-is-currently-being-sent/m-p/456102#M99430 amulay26 2019-08-19T13:20:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-a-custom-index-which-is-currently-being-sent/m-p/456103#M99431 <P>Please check whether or not you are using the correct serverclass. Perhaps the configuration is not even getting pushed into the forwarder. Hence even if you change on the DS, the FWD still shows the older version.</P> Mon, 19 Aug 2019 14:54:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-a-custom-index-which-is-currently-being-sent/m-p/456103#M99431 pramit46 2019-08-19T14:54:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-a-custom-index-which-is-currently-being-sent/m-p/456104#M99432 <P>The serverclass is correct too.</P> Mon, 19 Aug 2019 14:56:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-data-to-a-custom-index-which-is-currently-being-sent/m-p/456104#M99432 amulay26 2019-08-19T14:56:49Z