I am not a splunk expert. I am sure there is a slicker / better way to do it but this works for me. I did this on my heavy forwarder that feeds an index cluster. I copied this from /opt/splunk/etc/apps/TA-eStreamer/default/inputs.conf Where data is written to [monitor://$SPLUNK_HOME/etc/apps/TA-eStreamer/data] disabled = 0 source = encore sourcetype = cisco:estreamer:data crcSalt = I added this to /opt/splunk/etc/apps/TA-eStreamer/local/inputs.conf to overide the default [monitor://$SPLUNK_HOME/etc/apps/TA-eStreamer/data] disabled = 0 source = encore sourcetype = cisco:estreamer:data crcSalt = index = cisco My cisco:estreamer:data is now going to index cisco instead of index main ... View more