I am monitoring three scripts using the Universal forwarder and my inputs.conf looks like this:
[script:///opt/splunkforwarder/etc/apps/stax/bin/splunk-ram-cust1.sh]
disabled = false
interval = 60
sourcetype = ram_cust1
index = cust1
[script:///opt/splunkforwarder/etc/apps/stax/bin/splunk-disk-cust1.sh]
disabled = false
interval = 60
sourcetype = disk_cust1
index = cust1
[script:///opt/splunkforwarder/etc/apps/stax/bin/splunk-cpu-cust1.sh]
disabled = false
interval = 60
sourcetype = cpu_cust1
index = cust1
On the Indexer I am creating an index called 'cust1' to match what the Forwarder will be sending before I add the Monitor for the scripts. After I add the Monitor the data is received on my Indexer, but the Index of the first entry of the Ram Script and all entries from the cpu script will have an index of main. Why would this be happening?
