Route Traffic to Index via Transforms.conf and Props.conf

[hagjos43]

Here is our situation:
Universal forwarders(UF) on hosts (50-ish) are sending data to a heavy forwarder(HF) configured to store AND forward which is sending data to our Indexer. Our data is currently coming into the "main" index, however we would like it to go into a different index we'll call it "norris".

For simplicity let's just say we cannot modify the Universal Forwarders Inputs.conf.

I modified the props.conf and tranforms.conf on my indexer and had zero luck. Here is what I modified:

#props.conf
[host::chuck01]
TRANSFORMS-routing_for_norris_index = route_to_norris_index

#Transforms.conf
#Route to an alternate Index:
[route_to_norris_index]
DEST_KEY = _MetaData:Index
REGEX=(.*)
FORMAT = norris

Do I need to add this to the HF transforms and props as well?

[kheli]

try this in transforms.conf

[route_to_norris_index]
DEST_KEY = _MetaData:Index

note that there is space between REGEX and equal sign

REGEX = (.*)
FORMAT = norris

Also make sure that the host field value is correct

[hagjos43]

I tired and unfortunately it did not work.

Do the transforms and props config files need to be modified at the indexer or the Heavy Forwarder?