Hi, Thank you very much for your detailed answer. Here are the changes I have done. /opt/splunk/etc/system/local/props.conf: [host::SALSABDCO101] TRANSFORMS-dc_mog_qatar_cn = dc_mog_qatar_tn /opt/splunk/etc/system/local/transforms.conf: [dc_mog_qatar_tn] REGEX = .* DEST_KEY = _MetaData:Index FORMAT = idx_dc_do_mog These changes were done on both the indexers which are involved in indexing events from the host in question. SALSABDCO101 is the host running the UF whose events I would like to be indexed into idx_dc_do_mog Am I doing something incorrect, because I see events from host SALSABDCO101 being indexed into the index defined in inputs.conf under the domain controller app on the heavy forwarder. ... View more