This is used if you have already created the index and you want to forward message to that index. ... View more

Okey, thanks for the help. ... View more

Example messages: { "name":"value1"} , {"name":"value2"}, .... {"name":"valueN"} The main issue: Is it possible splunk automatically to create indexes with name "value1","value2",... if they does not exist and after that forward messages to that index. ... View more

I'm using this approach, but my idea is to create an index before forwarding. In my case the value of the index is part of the message , but it isn't known and I want to create an index with the same value from the message if it doesn't exist. ... View more