Renaming index for data coming from universal forwarder

[nawazns5038]

We have data coming from lots of universal forwarders and it has various sources and sourcetypes and sending data only to a single index.
we don't have access to inputs.conf.
How can we redirect the data to a different index.
Can we use transforms.conf to work on that particular index (i,e changing index name for data based only on existing index )

[niketn]

@nawazns5038, what do you mean by not having access to inputs.conf. How will you have access to props.conf and transforms.conf otherwise?

Ideally, you should send the data to correct index using inputs.conf (pushed to UF through a deployment server). However, on Indexer or HF, you can route data to specific index based on regular expression matches. Please refer to the following documentation:

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes#Route_specific_even...

[nawazns5038]

Hi @niketnilay ,

The inputs.conf belongs to other customers. we have access to our own indexers. we don't use deployment server as they have huge number of hosts.
Thanks for the link. helpful !!