Hi @fdharmawan, you have to insert in your Indexers and (if present) Heavy Forwarders, the following files: In $SPLUNK_HOME/etc/system/local/transforms.conf [overrideindex] DEST_KEY =_MetaData:Index REGEX = . FORMAT = my_new_index In $SPLUNK_HOME/etc/system/local/props.conf [host::your_ip_address] TRANSFORMS-index = overrideindex In addition I hint, you could create a dedicated app and insert these props.conf and transforms.conf in it: $SPLUNK_HOME/etc/apps/your_app/local Ciao. Giuseppe ... View more