I have setup the AMQP Messaging Modular Input to write to the amqp index but it's not working. It's reading from Rabbit, and the messages are removed. In the search console, I see the message in the _internal index but not in the amqp index. When I read the actual messages, it shows index=_internal.
I am using a local install of splunk. I also setup the rest api modular input and it works as expected.
In the splunk UI I see the index is set for amqp, and here is my config:
[amqp://RabbitMQ]
ack_messages = 1
activation_key = ****
exchange_name = event_bus
hec_batch_mode = 0
hec_endpoint = raw
hec_https = 0
hostname = localhost
index_message_envelope = 0
index_message_propertys = 0
log_level = TRACE
output_type = stdout
password = guest
port = 5672
queue_name = LogsAMQP
sourcetype = _json
use_ssl = 0
username = guest
index = amqp
routing_key_pattern =
virtual_host =
disabled = 1
