I have an HEC configured as follows: [http://customer] disabled = 0 index = index1 indexes = index1, index2, index3, index4 token = <token> sourcetype = _json however when I test the endpoint using the command: curl -k -L https://<mysplunkurl>/collector -H 'Authorization: Splunk <token>' -d '{"sourcetype": "local_cURL test", "event":"Test Event For New Index"}'...I get a successful 200 response, but the event doesn't appear under any of the configured indexes. Is this the correct configuration to send events to multiple indexes?
... View more