https://community.splunk.com/t5/Deployment-Architecture/Prevent-forwarder-from-re-forwarding/m-p/252233#M9531 <P>Do you mean to say splunk server1 is an indexer too?</P> <P>Anyway try this link to filter or route your data </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.3.1511/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/6.3.1511/Forwarding/Routeandfilterdatad</A></P> Mon, 07 Dec 2015 04:08:22 GMT renjith_nair 2015-12-07T04:08:22Z https://community.splunk.com/t5/Deployment-Architecture/Prevent-forwarder-from-re-forwarding/m-p/252232#M9530 <P>We have data being forwarded (heavy forwarder) to a spunk server 1 , and we also forward (heavy forwarder) from that splunk server 1 to an other splunk server 2.</P> <P>Is there a way to filter out forwarded messages so messages forwarded to server 1 are not sent to server 2 ?</P> <P>Thanks for any hints !</P> Fri, 27 Nov 2015 15:06:59 GMT https://community.splunk.com/t5/Deployment-Architecture/Prevent-forwarder-from-re-forwarding/m-p/252232#M9530 nicolasbussiere 2015-11-27T15:06:59Z https://community.splunk.com/t5/Deployment-Architecture/Prevent-forwarder-from-re-forwarding/m-p/252233#M9531 <P>Do you mean to say splunk server1 is an indexer too?</P> <P>Anyway try this link to filter or route your data </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.3.1511/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/6.3.1511/Forwarding/Routeandfilterdatad</A></P> Mon, 07 Dec 2015 04:08:22 GMT https://community.splunk.com/t5/Deployment-Architecture/Prevent-forwarder-from-re-forwarding/m-p/252233#M9531 renjith_nair 2015-12-07T04:08:22Z https://community.splunk.com/t5/Deployment-Architecture/Prevent-forwarder-from-re-forwarding/m-p/252234#M9532 <P>Let me know if it helped!</P> Thu, 10 Dec 2015 07:49:05 GMT https://community.splunk.com/t5/Deployment-Architecture/Prevent-forwarder-from-re-forwarding/m-p/252234#M9532 renjith_nair 2015-12-10T07:49:05Z