How to change what index SEP logs get set to?

[TheSplunkDude]

By Default all the SEP logs are going to the main index, how do I change this so it would go to a custom "SEP" index?

[rpille_splunk · Accepted solution]

If you are using the conf files for configuration, try adding index = SEP to each stanza.

If you are configuring on a node that has a Splunk Web UI, you can select an index on the Input Settings screen as you go through the GUI steps to define each file monitor input.