Here's my .conf entries
inputs.conf (in a custom application directory /splunk_home/etc/apps/myapp/local/inputs.conf)
[script:///splunk_home/bin/scripts/get_test_multi.pl]
disabled = 0
interval = 60000
source = get_test_multi
sourcetype = test_multi
index=test_index
props.conf (in /splunk_home/etc/system/local/props.conf)
[test_multi]
TRANSFORMS-index=test_index_router
EXTRACT-test_checker = splunk_index :: (?<test_index_field>.*?)\n
transforms.conf (in /splunk_home/etc/system/local/transforms.conf)
[test_index_router]
REGEX = splunk_index :: (?<my_splunk_index>.*?)\n
FORMAT = $1
DEST_KEY = _MetaData:Index
In props.conf you'll notice I extract a field called 'test_index_field' which is the same as the regex I'm using to route the index. I do this just to confirm that I'm correctly extracting the value which works correctly 100% of the time.
You might have some whitespace issues with your regex.
Try this:
REGEX = splunk_index :: (\w*)
The concern is that you may be including training whitespace in the capture of your index name, which would be tricksy to debug.
You might also want to try this:
[source::get_test_multi]
TRANSFORMS-index=test_index_router