Universal forwarder on windows - How do you identify the index to be used?

[jwilliams]

All,

  Using the universal forwarder for windows to send to my indexer.    I have installed the Splunk app for Windows on the indexer.  How does the indexer know the difference between Security, System, and Application logs?   Is that figured out automajically?

Thanks,

Jim

[gbansode]

@jwilliams 

Following link will help you to get a clear picture https://docs.splunk.com/Documentation/MSApp/2.0.4/MSInfra/HowtodeploytheSplunkAppforWindowsInfrastru...

For mapping logs to Indexes 
https://docs.splunk.com/Documentation/MSApp/2.0.4/MSInfra/DownloadandconfiguretheSplunkAdd-onforWind...

[PickleRick]

I don't remember the defaults but in order to send different logs into different indexes you need to configure inputs.conf on the forwarder. Then the forwarder sets the destination index when sending data to indexer which simply obeys.