How would I change the index of a sourcetype?

[ronniebotts87]

For example using WinEventLog: Security
In props.conf

[WinEventLog:Security]
TRANSFORMS-routing=forexamplename

And in transforms.conf

[forexamplename]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = rabblerabbleforexample

Appreciate any help with this as well if I'm doing it wrong.

[somesoni2]

Recommended method would be to update your inputs.conf, on the forwarder(s) where you're collecting it, to include new index name.

inputs.conf on forwarder

[WinEventLog://Security]
index= rabblerabbleforexample
...other attributes...

If for some reason, you can't do that, above props-transforms would work (setup on Indexer or heavy forwarder whichever comes first in your data flow. would require a restart of Splunk)

[valiquet]

If your data is already ingested, you can use |collect