Solution : index renaming not working when using _TCP_ROUTING

[splunkreal]

Hello, if you are using _TCP_ROUTING and index rename on target platform, logs may go to "last chance index" 

[splunkreal · Accepted solution]

In this case review inputs.conf sourcetype and change it if you use default pretrained :

https://docs.splunk.com/Documentation/Splunk/9.3.0/Data/Listofpretrainedsourcetypes

"The source types marked with an asterisk ( * ) use the INDEXED_EXTRACTIONS attribute, which sets other attributes in props.conf to specific defaults and requires special handling to forward to another Splunk platform instance. See Forward fields extracted from structured data files."