Data from forwarder going to wrong index

[mbernardo]

I am monitoring three scripts using the Universal forwarder and my inputs.conf looks like this:

[script:///opt/splunkforwarder/etc/apps/stax/bin/splunk-ram-cust1.sh]

disabled = false

interval = 60

sourcetype = ram_cust1

index = cust1

[script:///opt/splunkforwarder/etc/apps/stax/bin/splunk-disk-cust1.sh]

disabled = false

interval = 60

sourcetype = disk_cust1

index = cust1

[script:///opt/splunkforwarder/etc/apps/stax/bin/splunk-cpu-cust1.sh]

disabled = false

interval = 60

sourcetype = cpu_cust1

index = cust1

On the Indexer I am creating an index called 'cust1' to match what the Forwarder will be sending before I add the Monitor for the scripts. After I add the Monitor the data is received on my Indexer, but the Index of the first entry of the Ram Script and all entries from the cpu script will have an index of main. Why would this be happening?

[Michael]

don't know if this was ever answered, but I think it might lie in putting an index.conf file in /opt/splunk/etc/system/local/ that reads:

[ram_cust1]
homePath = $SPLUNK_DB/cust1/db
coldPath = $SPLUNK_DB/cust1/colddb
thawedPath = $SPLUNK_DB/cust1/thaweddb

[disk_cust1]
homePath = $SPLUNK_DB/cust1/db
coldPath = $SPLUNK_DB/cust1/colddb
thawedPath = $SPLUNK_DB/cust1/thaweddb

[cpu_cust1]
homePath = $SPLUNK_DB/cust1/db
coldPath = $SPLUNK_DB/cust1/colddb
thawedPath = $SPLUNK_DB/cust1/thaweddb