We would like to override ANY index name coming from Universal Forwarders. We would like to do this at our Heavy Forwarders. Here is the config we are using on our HFs that is not working: inputs.conf [splunktcp-ssl:9997] disabled = 0 index = *new_index_name* _TCP_ROUTING = autolb-group [SSL] rootCA = /opt/splunk/etc/auth/cacert.pem serverCert = /opt/splunk/etc/auth/server.pem password = *password* outputs.conf [indexAndForward] index = false selectiveIndexing = false [tcpout] defaultGroup = autolb-group [tcpout:autolb-group] disabled = false server = *forwarders* sslCertPath = /opt/splunk/etc/auth/server.pem sslPassword = *password* sslRootCAPath = /opt/splunk/etc/auth/cacert.pem sslVerifyServerCert = false useACK = false props.conf [myindex] TRANSFORMS-index=overrideindex transforms.conf [overrideindex] REGEX = (.*) FORMAT = *new_index_name* SOURCE_KEY=_MetaData:Index DEST_KEY = _MetaData:Index ... View more

We have many systems with Universal Forwarders sending to a dedicated Heavy Forwarder. We would like to put a 3rd party load balancer in-between the UFs and HF to assist with scaling and automation. Is it possible to disable load balancing between the UFs and the HF ? Can I set autoLB = false to do this? ... View more