There is no such thing as "index listening". It's forwarder's job to collect data, prepare it properly (most importantly add proper metadata like source, sourcetype, host and destination index) and send it to the destination indexer or intermediate forwarder. So you don't have to change anything on the index side itself. Index is just a "bag" receiving events flowing from your forwarders. You need to find where the data comes from and check forwarder's configuration on that system. If this particular piece of configuration is being pushed from the deployment server in a pre-set state, that might be a bit more complicated. But the question which can affect other stuff as well (like apps assigned to this server) is how the server syslog_01 was "migrated" to syslog_02. Especially concerning the splunk forwarder's config. If it was simply moved from one server to another there is a possibility that the forwarder's name might have been set to a static value in the config and has been retained after the configuration was moved so your new forwarder will still report to your DS under the old name. Messy. ... View more