I would like to forward logs from sources coming from udp inputs in a Heavy Forwarder to two splunk clouds with different index names each one. I have a fortinet source coming from server1 (fortinet index), a eset source coming from server2 (eset index) and others sending logs to a Heavy Forwarder with udp inputs. For the forwarding to splunk clouds I have two splunkclouduf.spl installed for each one that configure the forwarding at Heavy Forwarding. So I have these apps installed on the Heavy Forwarder: 100_foo1_splunkcloud and 100_foo2_splunkcloud. I would like to: - Send all logs to foo1.splunkcloud.com with predefined index. - Send only fortinet and eset sources to foo2.splunkcloud.com and change the index to foo2_fortinet and foo2_eset respectively. For this scenario I propose this config: $SPLUNK_HOME=/opt/splunk /opt/splunk/etc/system/local/props.conf     [host::server1] TRANSFORMS-routing1=app_foo1 TRANSFORMS-routing2=fortigate_foo2_index,app_foo2 [host::server2] TRANSFORMS-routing3=app_foo1 TRANSFORMS-routing4=eset_foo2_index,app_foo2     /opt/splunk/etc/system/local/transforms.conf     [app_foo1] REGEX=. DEST_KEY=_TCP_ROUTING FORMAT=<splunkcloud_foo1> [app_foo2] REGEX=. DEST_KEY=_TCP_ROUTING FORMAT=<splunkcloud_foo2> [fortigate_foo2_index] REGEX=. DEST_KEY=_MetaData:Index FORMAT=foo2_fortinet [eset_foo2_index] REGEX=. DEST_KEY=_MetaData:Index FORMAT=foo2_eset     /opt/splunk/etc/apps/100_foo1_splunkcloud/local/outputs.conf     [tcpout:splunkcloud_foo1] <sslPassword for foo1>     /opt/splunk/etc/apps/100_foo2_splunkcloud/local/outputs.conf     [tcpout:splunkcloud_foo2] <sslPassword for foo2>     /opt/splunk/etc/apps/100_foo1_splunkcloud/default/outputs.conf     [tcpout:splunkcloud_foo1] server = <bunch of 15 balanced server of foo1.splunkcloud>     /opt/splunk/etc/apps/100_foo2_splunkcloud/default/outputs.conf     [tcpout:splunkcloud_foo2] server = <bunch of 15 balanced server of foo2.splunkcloud>     Is a valid configuration for the scenario? ... View more