This is kindof an important feature. it's been 2 years now and still nothing 😞 ... View more

Hi Bryan, The source type the data needs to be tagged with, and the index it needs to be sent to are both specified by the Splunk Universal Forwarder (SUF) in its inputs.conf file before the data is sent to Splunk. I don't understand what you mean by "the type and index are specified when you create the input in Splunk". I am trying to replace the splunk universal forwarder completely with NiFi. The load balancing tips are helpful. ... View more