Brand new to splunk, inherited a slightly configured system. I want to move certain cribl events to an index called vmware. I added this... props.conf [sourcetype::cribl] TRANSFORMS-index = route_to_vmware transforms.conf [route_to_vmware] REGEX = (?i)vpxa DEST_KEY = _MetaData:Index FORMAT = vmware Created an index in splunk. Example of event, ending up in main index... any help would be appreciated.  thank you I did restart splunk from the GUI after changes were made. ... View more