instead of storing the cisco firewall logs into "summary" index. i would like to store in a index called "firewall".
other than creating the index "firewall", and adding index = firewall into the local/inputs.conf, what else must i do?
Changing the inputs is a good start.
If some data are generated using summary searches, then you need also to check the destination index of the summary. (default is summary). see in savedsearches.conf
