I build distributed Splunk Enterprise network the network flow is like below UF--->HF------->IDX----->SH
In which I monitor a log file using inputs.conf [monitor:///var/log/syslog]
disabled = false
index = new_indexer
I also created a new index in Indexer
But the log files are not indexing in indexer.
if I remove the index stanza in inputs.conf file the data is now indexing on the indexer.
Now here my question
How I specify the index to route the data to specific index?
You need to put your monitor stanza on the UF node and then make sure that it has index=new_index_not_new_indexer. Then make sure that that same UF has an outputs.conf file that points to your indexer tier (OR to your HF tier but preferably not to HF as you probably should not be using an HF tier anyway). Then restart Splunk on your UF to start sending in. Your problem is probably that you are confusing index (the name of the DB where you data buckets are stored) and indexer (the server that has it's own subset of all the index data). There is no indexer setting in inputs.conf, only index settings. Similarly, there is no index setting in outputs.conf, only indexer settings.