I am trying to create a stanza in props.conf so that all non splunk internal logs go to index=newindex.
I tried using negative lookahead as follow:
But it doesn't work.
Instead of using props.conf you can use inputs.conf to route internal logs to other index.
index = newindex
We cannot change the config at UF.