I am using the universal forwarder on a windows box to send data back to a single instance Splunk install on a Linux box. The existing Windows App install on the Linux host doesn't allow configuration at all, which for the local host I don't care about. However all the default reports/dashboards for Performance Monitoring the source it is looking for is "WMI:" instead of what is created from the Universal Forwarder which is "Perfmon:". This kills any default data pulls when standing up new Windows forwaders. The only solution seems to be updating the default dashboard XML docs to use the new sources. This goes the same for events going to an index other than the default.
Is there a way on a Linux host to easily update how the data is being pulled in from a Universal Forwarder? Is there a way to direct the app to a custom Index without having to alter the base reports?
