Configure universal forwarder to send all logs to a specific index regardless of what logs are being ingested

[Runals]

I feel like I'm asking a question I should know the answer to. We are setting up what will be a large and distributed splunk environment. The probable scenario is individual orgs will have one or more forwarders and we'd like to have all of the data from any particular org going into its own index regardless of log content: OS, firewall, etc. Unless I'm off base the place to configure which index data will go is the inputs.conf file. Even though we will be using a deployment server the individual orgs will be responsible for installing the UF/HF and ultimately will have access to modify things like the etc/local/inputs.conf file even if we tell them not to.

Since the forwarder builds the inputs.conf file from the various places it can reside my thought is to create an inputs.conf app for all forwarders in an org that says regardless of WHAT is being ingested to put it in the right index. This would be appended to whatever they might tweak outside of my perview. Is this the right approach and how do I accomplish this? My thought is something like the following

deployment-apps/all_forwarders_in_org_xyz_inputs/local/inputs.conf

[source:*]
index=xyz's_index

That stanza string doesn't strike me as the right way to approach this.

[bmacias84 · Accepted solution]

You can just set the [default] stanza in your inputs.conf within your deployment app.

[default]

index=##yourNewDefaultIndex##

Thank you @yannK
Answers default index for all forwards inputs

[Runals]

Good deal. Thanks!