Are you saying that the events/data you expect to go into index=doit_app_c4_168 are ending up in index=_internal ? Or are you just seeing data appear in the internal indexes for the Forwarder that you expect the data to come from?
Can you share your settings for:
From UF:
inputs.conf
From IDX:
props.conf
indexes.conf
For troubleshooting this, you don't want to rely just on what you put into the conf files. At runtime Splunk will coalesce all of the conf files from all of the underlying default/local directories of etc/system and etc/apps . So you should also use btool to help see what is going on.
For example, let's say you want to check the runtime status of your input stanza for your log file, and your definition in this case is called "doit_app_logs". You would run the following on the forwarder:
splunk btool inputs list | grep "\[doit_app_logs\]" -A 10
You can do the same from an Indexer to check on the runtime configs of your index, too:
splunk btool indexes list | grep "\[doit_app_c4_168\]" -A 10
... View more
