For example using WinEventLog: Security
In props.conf
[WinEventLog:Security]
TRANSFORMS-routing=forexamplename
And in transforms.conf
[forexamplename]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = rabblerabbleforexample
Appreciate any help with this as well if I'm doing it wrong.
Recommended method would be to update your inputs.conf, on the forwarder(s) where you're collecting it, to include new index name.
inputs.conf on forwarder
[WinEventLog://Security]
index= rabblerabbleforexample
...other attributes...
If for some reason, you can't do that, above props-transforms would work (setup on Indexer or heavy forwarder whichever comes first in your data flow. would require a restart of Splunk)
If your data is already ingested, you can use |collect