topic Re: Stash data going to main index in Getting Data In

Stash data going to main index

Bentash — Tue, 22 Oct 2019 20:21:11 GMT

anyone knows why stash sourcetype for a particular app(demisto in this case) going to index=main?
i believe these are notables. I will like to know which .conf file contains this setting and how to change from main index to another index.

Thanks
Ben

Re: Stash data going to main index

sandeepmakkena — Tue, 22 Oct 2019 20:58:41 GMT

Check your inputs.conf file and see what index is specified init. I think by default it will have index=main, update it to index=YourIndexName and restart the service.

Re: Stash data going to main index

Bentash — Thu, 24 Oct 2019 18:53:01 GMT

Thanks Sandeep but there is nothing in inputs.conf