Hi,
I want to monitor a whole bunch of Universal Forwarders that i have set up and configured. All data from these are all forwarded to a heavy forwarder that forwards everything to Splunk Cloud.
My problem is that i have only access to one index in the cloud, but not the _internal index that receives UF metrics. Is it possible to change the index from _internal to the one I have access to in the UF config?
While, in theory, it may be possible to have the data go to a different index, I advise against it. First, some of the references to _internal may be hardcoded so you won't be able to change 100% of the events. Second, making such a change may have side effects such as built-in dashboards and alerts no longer working. Finally, data written to _internal is free whereas sending to a different index will count against your license.