It would be ideal to send the syslog data straight to Splunk, and setup a separate port for the for the handful of hosts -- since you can specify an Index when defining the data input.
Otherwise, you could use a RegEx to identify the data you want to move, like this:
PROPS.CONF:
[source::...mysyslogfile...]
TRANSFORMS-movestuff = xf_index
TRANSFORMS.CONF:
[xf_index]
REGEX = matchthis
DEST_KEY = _MetaData:Index
FORMAT = thisindex
Use FORMAT to specify the index name. Don't forget to create your index, first.