Here is our situation:
Universal forwarders(UF) on hosts (50-ish) are sending data to a heavy forwarder(HF) configured to store AND forward which is sending data to our Indexer. Our data is currently coming into the "main" index, however we would like it to go into a different index we'll call it "norris".
For simplicity let's just say we cannot modify the Universal Forwarders Inputs.conf.
I modified the props.conf and tranforms.conf on my indexer and had zero luck. Here is what I modified:
TRANSFORMS-routing_for_norris_index = route_to_norris_index
#Route to an alternate Index:
DEST_KEY = _MetaData:Index
FORMAT = norris
Do I need to add this to the HF transforms and props as well?