I have setup the AMQP Messaging Modular Input to write to the amqp index but it's not working. It's reading from Rabbit, and the messages are removed. In the search console, I see the message in the _internal index but not in the amqp index. When I read the actual messages, it shows index=_internal. I am using a local install of splunk. I also setup the rest api modular input and it works as expected. In the splunk UI I see the index is set for amqp, and here is my config: [amqp://RabbitMQ] ack_messages = 1 activation_key = **** exchange_name = event_bus hec_batch_mode = 0 hec_endpoint = raw hec_https = 0 hostname = localhost index_message_envelope = 0 index_message_propertys = 0 log_level = TRACE output_type = stdout password = guest port = 5672 queue_name = LogsAMQP sourcetype = _json use_ssl = 0 username = guest index = amqp routing_key_pattern = virtual_host = disabled = 1
... View more