Change Index name of some data from HEC

[karthikm]

I have a HEC token sending various logs from AWS Cloudwatch. HEC token is set to have two indexes paloalto and aws.

And all the data is going to the default index aws.

I want all the data from the source=syslogng to be sent to index=paloalto instead of index=aws.

Should I change the inputs.conf or props.conf for the splunk_httpinput in the deployment apps?

[PickleRick]

If you have a HEC input, you can define which indexes the input is limited to. But if you want other index than the default one, the source sending events must specify it.

Otherwise you have to overwrite metadata later duing ingestion phase https://docs.splunk.com/Documentation/Splunk/9.1.0/Forwarding/Routeandfilterdatad