Hi, I'm trying to forward all data received by one indexer to a third party Indexer, but rewriting the index for the data sent to the third party. Everything is configured to come in from the UF's using specific index's (Such as WinEventLog). SplunkA indexes the data into those index's happily. There is a requirement to forward all data to SplunkB, but to a dedicated index (Such as SubsidiaryIndex instead of WinEventLog). I was originally using IndexandForward in an outputs.conf, but the forwarded data includes the index set by the UF's. The guide here is close to what I want to do, but I want it to forward all data, and rewrite the index - https://docs.splunk.com/Documentation/Splunk/8.0.5/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system  props.conf - Note: I feel like the default stanza is wrong, but I'm not sure how else to capture everything. Also, I've tried TRANSFORMS-routing and TRANSFORMS-forward...   [default] TRANSFORMS-routing = routeAll   transforms.conf   [routeAll] REGEX=(.) DEST_KEY = _MetaData:Index FORMAT = SubsidiaryIndex DEST_KEY=_TCP_ROUTING FORMAT=Subsidiary   outputs.conf   outputs.conf [tcpout] defaultGroup=nothing [tcpout:Subsidiary] disabled=false sendCookedData=false server=169.254.153.83:9999   Any guidance would really be appreciated!  ... View more

The WindowsUpdate.log file is being generated using the Splunk Add-on for Microsoft Windows app. ## Enable below powershell and monitor stanzas to get WindowsUpdate.log for Windows 10 and Server 2016 ## Below stanza will automatically generate WindowsUpdate.log daily [powershell://generate_windows_update_logs] script = ."$SplunkHome\etc\apps\Splunk_TA_windows\bin\powershell\generate_windows_update_logs.ps1" schedule = 0 */24 * * * ## Below stanza will monitor the generated WindowsUpdate.log in Windows 10 and Server 2016 [monitor://$SPLUNK_HOME\var\log\Splunk_TA_windows\WindowsUpdate.log] sourcetype = WindowsUpdateLog However, the Splunkd.log shows it's always 'in use'? As such, I obviously don't get any data into Splunk. 06-18-2019 20:43:09.817 +1000 WARN TailReader - Access error while handling path: failed to open for checksum: 'C:\Program Files\SplunkUniversalForwarder\var\log\Splunk_TA_windows\WindowsUpdate.log' (The process cannot access the file because it is being used by another process.) This is happening on every server I've deployed the Splunk Add-on for Microsoft Windows app. Is there something I've missed? ... View more