set indexes dynamically in inputs.conf

Getting Data In

I was able to set indexes dynamically in inputs.conf based off the source path folder name however, it seems like its not working in Splunk cloud. I have tried to upload a app with the props and transforms and also tried to use a HWF as well. hoping someone out there might be able to help.

this is basically what my conf files look like-

-props-

[source::\\fileshare\\folder\\...]
TRANSFORMS=send_to_index_by_source

-transforms-

[send_to_index_by_source]
SOURCE_KEY=_MetaData:Source
REGEX=\\\wfileshare\\\wfolder\\(\w+)
DEST_KEY=_MetaData:Index
FORMAT=$1

-inputs-

[monitor://\\fileshare\folder\...\test15.txt]
disabled=false
recursive=true
sourcetype=test15

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...