For example using WinEventLog: Security
And in transforms.conf
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = rabblerabbleforexample
Appreciate any help with this as well if I'm doing it wrong.
Recommended method would be to update your inputs.conf, on the forwarder(s) where you're collecting it, to include new index name.
inputs.conf on forwarder
If for some reason, you can't do that, above props-transforms would work (setup on Indexer or heavy forwarder whichever comes first in your data flow. would require a restart of Splunk)
If your data is already ingested, you can use |collect