I have a deployment server that has within the index.conf file a line that states
[default] index = lab_dmz
Yet all of my data is being dumped into the _internal index. I have run "splunk cmd btool inputs list and it correctly lists the index as lab_dmz.
It works for another deployment app that I have but not this one.
