How do you set Cisco Add-on to a specific index?

[wralph_EPACN]

I am looking at how to set a specific index for this add-on as we have multiple groups responsible for Cisco devices, and we do not want them to see each others logs.

Any idea how to do this?

[skurasak1]

Did you ever get an anwer for this, I'm having the same problem, my universal forwarder sends it to my indexer to specific index, but the TA_cisco_ios doesn't  seem to do transform to correct the hostname for me.  I'm not clear on what specific change on TA props.conf or transform.conf to read the specific index.

[PickleRick]

1. It's an old thread. It's often that people aren't even active on Answers after several years.

2. An index is just a place for events "storage". Whether props/transforms work or not is not index-specific (ok, it _can_ be made index-specific but you have to work to explicitly make it so; you can safely assume that it's a very very unlikely case).

So if your index-time mechanism doesn't work, it's either defined in a wrong place (where do you have your settings defined?) or is not written properly.

[lakshman239]

create indexes.conf under etc/apps//local to have your index. Then in the inputs.conf, for that monitor stanza/syslog etc.. you can setup index and sourcetype.