Hi @rvk_sp_user, No, when an event with the sourcetype you defined in props.conf (mysourcetype) arrives to the Indexer or (if present) to the Heavy Forwarder, it's checked if the event contains the regex that you defined in transforms.conf: if the regex matches, the value for index that you fixed in inputs.conf is overwritten with the new value that you defined in transforms.conf (your_new_index), if it doesn't matches, original index value remains. This means that in inputs.conf you have to put the default value for index and in transforms.conf you have to put the new index value associated to a regex. If you have to assign more index values, you have to create more stanzas in props.conf and transforms.conf with different regexes. Ciao. Giuseppe ... View more