Hi Everyone!.
I'm here to share the resolution for one of the frequent errors that we see in internal logs and sourcetype=splunkd.
If you happen to encounter the below error,
"Failed processing http input , token name=token_name,parsing_err="Incorrect index", index=index_name"
Please make sure that your index name is being added to the respective token(HEC).
In order to avoid this error, make sure your index is added under the respective token as soon as a new index is created.
[https://token name]
disabled = 0
index=default_index name
indexes=index1,index2, index3;[add your index here]
Cheers
