How to configure universal forwarder to forward events from a specific log file in a monitored directory to a separate index?

[gn694]

I have a Windows computer where I need to configure the Splunk Universal Forwarder in the following way:

One large log directory is indexed in the "main" index. There are a lot of log files here.
One specific log file in this directory needs to go to a separate index (for longer retention purposes.)

What is the best way to handle this? I think setting a blacklist value for this specific log file is the best way, but was curious of anyone has any other input.

But... what would happen if I have a monitoring stanza for the whole directory going to one index and another monitoring stanza for the ONE file in the directory going into another index? If it would get indexed twice that is not a problem in this case. But I suspect Splunk is not going to forward the events from that one file twice, once into each index.

Here is my Proposed Solution for indexes.conf:

[default]
index=main

[monitor://C:\logs]
disabled = 0
ignoreOlderThan = 7d
blacklist=C:\logs\onelog.log

[monitor://C:\logs\onelog.log]
index=NewIndex
disabled = 0

[kml_uvce · Accepted solution]

This is correct way to blacklist the file that you want to send in another index.
Yes,It would be indexed twice in different index if you send same file in different index.