anyone knows why stash sourcetype for a particular app(demisto in this case) going to index=main?
i believe these are notables. I will like to know which .conf file contains this setting and how to change from main index to another index.
Thanks
Ben
Check your inputs.conf
file and see what index is specified init. I think by default it will have index=main, update it to index=YourIndexName
and restart the service.
Thanks Sandeep but there is nothing in inputs.conf