This isn't your config — it's a default the UF ships with. The internal-log monitor stanzas in $SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/default/inputs.conf come with _TCP_ROUTING = *, which means "send to all tcpout groups." So the moment you added group2, _internal started cloning to both. Your override was close but missed two things: [splunkd] is a sourcetype, not an input stanza — _TCP_ROUTING only works on the actual [monitor://...] stanza, so that line does nothing. _internal is fed by multiple monitors (splunkd.log, metrics.log, etc.), each with its own _TCP_ROUTING = *. You only overrode splunkd.log; the rest keep cloning to both groups. (Side note: props/transforms routing won't work on a UF — it doesn't parse. _TCP_ROUTING in inputs.conf is the only lever. And internal indexes require an explicit _TCP_ROUTING, so override it to group2 — don't delete it.) Fix. Enumerate what your version actually ships:   $SPLUNK_HOME/bin/splunk btool inputs list --debug | grep -i "TCP_ROUTING" Then in $SPLUNK_HOME/etc/system/local/inputs.conf, override each internal stanza (header + routing line is enough; index/sourcetype still layer in from default):   [monitor://$SPLUNK_HOME/var/log/splunk/splunkd.log] _TCP_ROUTING = group2 [monitor://$SPLUNK_HOME/var/log/splunk/metrics.log] _TCP_ROUTING = group2 Add a block for every _internal stanza btool listed — any you skip keeps going to group1. Same applies to _audit (audit.log) and _introspection if you want those off group1 too. Restart, then re-run the btool grep to confirm they all resolve to group2. If you meant something other than a reply to post, let me know. ... View more

Hi @dairontorresz  You can do this entirely over REST on port 8089. 1. Check the object's ACL first: curl -k -u admin:PASSWORD -X GET \ "https://SEARCHHEAD:8089/servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches" \ --get -d search="My Custom Alert" -d output_mode=json Look at removable and can_write in the acl block. If removable is false, no API call will delete it — the stanza is in a default/ directory and can only be disabled. 2. Grant write if can_write is false (owner and sharing are required on every ACL post): curl -k -u admin:PASSWORD -X POST \ "https://SEARCHHEAD:8089/servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches/My%20Custom%20Alert/acl" \ -d owner=admin -d sharing=app -d perms.write=admin 3. Delete: curl -k -u admin:PASSWORD -X DELETE \ "https://SEARCHHEAD:8089/servicesNS/nobody/SplunkEnterpriseSecuritySuite/saved/searches/My%20Custom%20Alert" \ -w "\nHTTP %{http_code}\n" Two gotchas: URL-encode the search name (spaces to %20) — that's the usual cause of a 404 — and use nobody in the namespace for app-shared objects, or the owner's username if it's still private. A 403 means you need admin_all_objects or write on the app itself. if it's work give the kerma ... View more