I created essentially a shell named index within the GUI (settings>indexes) on the hvy fwdr box called mscloud within the "Splunk_TA_microsoft-cloudservices app context" so that within the mscloud setup pieces you can choose that index. With forwarding setup correctly, it doesn't go to the local index, but would auto-forward onto the index cluster under the mscloud index name.
... View more