Inputs not routing to correct index

[rmcdougal]

I have data being sent in by universal forwarders on port 9908 that I would like put into a custom index. This is how I have my C:\Program Files\Splunk\etc\system\local\inputs.conf setup.


[splunktcp://9908]
index = pc


However, the data from those universal forwarders is getting indexed into the "main" index. Any ideas why it is ignoring my index selection.

[Damien_Dallimor]

The splunktcp input is for receiving "cooked" data (vs a raw TCP data input), so try specifying the "index" in the Universal Forwarder's inputs.conf instead.

If you do need to set the meta fields (index, sourcetype, source etc..) on the Receiver side using splunktcp , it is best to do this with index time field transforms using props.conf and transforms.conf