I have a new data set being pushed via Splunk REST API. Because I am using selective indexing, I have some indexes stored locally, some don't. It's all set via _INDEX_AND_FORWARD_ROUTING.
However, it doesn't seem to work for this new data set coming in from the REST API.
Others are not via the REST API, and other data show up during the search.
Here is what I put in as a new stanza in inputs.conf.
[monitor:///opt/splunk/var/lib/splunk/new-ind/db]
index = new-ind
source = restAPI
sourcetype = web_event
_INDEX_AND_FORWARD_ROUTING = new-ind
Any help will be appreciated.
