When you do a "pull" for data instead of a "push", you have to write some glue. You need a Universal Forwarder as a way-station and then you write a script to go to the source machine and pull the data to the UF. You then use traditional means to forward from there, being careful to use the original host for field host (instead of the UF's value). ... View more

1) Which props/trasnforms files you alter may depend on your other configurations. You can use btool to ensure the configurations you create are being handled as you want them. 2) That depends on what sourcetype the data is created with. When you search for this data in your Splunk instance, what do you see for the sourcetype? 3) You should not need to re-index, but you should at least perform a debug/refresh (yoursplunkhost:8000/debug/refresh, and click the button that is shown there) to inform Splunk to re-read its configuration. ... View more