Change File/Directory Input Index

[bteele]

In our distributed environment, we've got our File/Directory data inputs configured on our deployment server, and our production indexes on our indexer. The indexes aren't replicating between the two.

When I add a new File/Directory data input, I can choose an index, but only those local to the deployment server. The index I want to use, on the Indexer, isn't available in the dropdown.

How can I change that index? I've looked for a config file on either server, but can't find anything to manually configure.

[p_gurav]

If you have indexer clusetring , you need to put indexes.conf on master node in "$SPLUNK_HOME/etc/master-apps//local".

If you don't have clustering then you can create one index on deployment server, but while doing file and directory monitoring make sure you are doing it in forwarded input not in local input.

Below docs may help:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Forwarddata