Brand new to splunk, inherited a slightly configured system. I want to move certain cribl events to an index called vmware. I added this... props.conf [sourcetype::cribl] TRANSFORMS-index = route_to_vmware transforms.conf [route_to_vmware] REGEX = (?i)vpxa DEST_KEY = _MetaData:Index FORMAT = vmware Created an index in splunk. dtamburin_0-1747146327495.png Example of event, ending up in main index... dtamburin_1-1747146419579.png any help would be appreciated.  thank you I did restart splunk from the GUI after changes were made. ... View more