Since this is a heavy forwarder the data is cooked on this server, therefore the index setting is done here.
Is it possible to get both sets of indexers to use the same index for this data?
If not the transforms.conf might work but you would need to do the transform based on which output was chosen, and I'm unsure how to do that part, also DB Connect can set an index, but it will only set one per input.
Perhaps you can change your indexers to have the same index name?
Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/ Version Control for Splunk https://splunkbase.splunk.com/app/4355/
We have tried this. This is not working because the data which generates is HF and we tried to override at the indexer, so on the HF it is passed the parsing queue and set the metadata file so will not be able to override at the indexer.