By Default all the SEP logs are going to the main index, how do I change this so it would go to a custom "SEP" index?
If you are using the conf files for configuration, try adding index = SEP to each stanza.
If you are configuring on a node that has a Splunk Web UI, you can select an index on the Input Settings screen as you go through the GUI steps to define each file monitor input.
If you are using the conf files for configuration, try adding index = SEP to each stanza.
If you are configuring on a node that has a Splunk Web UI, you can select an index on the Input Settings screen as you go through the GUI steps to define each file monitor input.