This is an example from the following section of the documentation. Send all events from a data input to a specific index To send all events from a particular data input to a specific index, add the following line to the input's stanza in inputs.conf on <strike> the Splunk Enterprise component where the data is entering the system:</strike> either the indexer itself or a forwarder sending data to the indexer: index = <index_name> The following example inputs.conf stanza sends all data from /var/log to an index named fflanda: [monitor:///var/log] disabled = false index = fflanda ... View more