Hello, we have a splunk instance that is being fed by a splunk heavy forwarder. We have a rsyslog linux server forwarding logs from our network and linux servers to the heavy forwarder, which is setting the index=syslog and sourcetype=syslog. We have our Windows servers sending the event logs using the universal forwarder on each server, setting the index=wineventlogs, to the heavy forwarder as well. On the heavy forwarder, the outputs.conf is set to the splunk instance over port 9997. On the instance, we have the receive port configured. It appears that the universal forwarder sets the source type to wineventlog, so does the index and sourcetype get changed when the logs get to the heavy forwarder, since the inputs.conf is configured as such? Or does the config from the universal forwarder hold?
