Hello @gcusello, no luck 😞 props.conf [source::stream:Splunk_postgres] TRANSFORMS-stream-postgres = set_index_hue transforms.conf [set_index_hue] REGEX = . DEST_KEY = _MetaData:Index FORMAT = hue     ... View more

Hello, @gcusello I know,  I have to move only stream:postgres to diferent index ... View more

Hello again, sample of sources: stream:Splunk_IP stream:Splunk_Tcp stream:Splunk_SSLActivity stream:Splunk_Udp stream:Splunk_DNSRequestResponse stream:Splunk_DNSIntegrity stream:Splunk_DNSServerQuery stream:Splunk_DNSServerResponse stream:Splunk_DNSClientQueryTypes stream:Splunk_DNSClientErrors stream:Splunk_Postgres I would like to catch only stream:Splunk_Postgres ... View more

Hello, @gcusello I've attached some screenshots. Best regards M.   ... View more

Hi, I understand and agree with You. But fresh install doesn’t have federated in README…   Best regards M. ... View more

Hi again, Fresh 9.0.0 install   find $SPLUNK_HOME/ -name federated.conf* /opt/splunk/var/run/splunk/confsnapshot/baseline_default/system/default/federated.conf /opt/splunk/etc/system/default/federated.conf   8.2.7 -> 9.0.0 install find $SPLUNK_HOME/ -name federated.conf* /opt/splunk/etc/system/README/federated.conf.spec /opt/splunk/etc/system/README/federated.conf.example /opt/splunk/etc/system/default/federated.conf /opt/splunk/var/run/splunk/confsnapshot/baseline_default/system/default/federated.conf     root@srvslprosplunk1:/opt# mv /opt/splunk/etc/system/README/federated.conf.spec /home/splunk/ root@srvslprosplunk1:/opt# mv /opt/splunk/etc/system/README/federated.conf.example /home/splunk/ root@srvslprosplunk1:/opt# splunk/bin/splunk btool check –debug | grep fede   No spec file for: /opt/splunk/etc/system/default/federated.conf   /etc/inid.d/splunk start … … Splunk> Finding your faults, just like mom.   Checking prerequisites...         Checking http port [8000]: open         Checking mgmt port [8089]: open         Checking appserver port [127.0.0.1:8065]: open All preliminary checks passed. … Starting splunk server daemon (splunkd)... If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com   The Splunk web interface is at https://xxx:8000   Works fine. ... View more