Hi Folks, New to Splunk and SC4S deploymenet. So far I have been able to make good progress. I have setup 2 SC4S servers one on linux and the other on windows with WSL. The challenge that I am facing is that all the syslogs are doing to the default indices. For example I see that the FW logs are going to netfw. I am trying to move them to a new index that I have created- index_new. I have tried editing the splunk_metadata.csv file but I still see the logs going to netfw. i have tried different configurations but nothing worked.  fortinet_fortigate,index, index_new or ftnt_fortigate, index,index_new or  netfw,index,index_new In the HEC configuration, I have not selected any index and left it blank. The default index is set to index_new Thank you in advance. PS: I have also tried the Maciek Stopa's posfilter.conf script as well. ... View more