topic Re: How to forward specific event data from HF to indexer in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-forward-specific-event-data-from-HF-to-indexer/m-p/612417#M105970 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/246238">@medtemo</a>,</P><P>on Indexers there's no needed change.</P><P>at HF level, you have to apply the process described at&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.0.1/Forwarding/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data_input" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.1/Forwarding/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data_input</A></P><P>Ciao.</P><P>Giuseppe</P> Thu, 08 Sep 2022 13:23:01 GMT gcusello 2022-09-08T13:23:01Z How to forward specific event data from HF to indexer? https://community.splunk.com/t5/Getting-Data-In/How-to-forward-specific-event-data-from-HF-to-indexer/m-p/612416#M105969 <P>Hello ALL,<BR />My deployment is UF ----&gt;HF(local copy)-----&gt;indexer<BR />I would like to send logs from HF to indexer except some sourcetype,<BR />at the same time need to keep a local event copy of all forwarded logs from<BR />UF in HF.<BR />I have found a number of seemingly great answers and help pages for how to set this up with props.conf and transforms.conf but no luck.</P> <P>At what level do I need to change configuration HF or Indexer?<BR />please suggest how to achieve this.</P> <P>Thanks,</P> Thu, 08 Sep 2022 16:59:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-specific-event-data-from-HF-to-indexer/m-p/612416#M105969 medtemo 2022-09-08T16:59:54Z Re: How to forward specific event data from HF to indexer https://community.splunk.com/t5/Getting-Data-In/How-to-forward-specific-event-data-from-HF-to-indexer/m-p/612417#M105970 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/246238">@medtemo</a>,</P><P>on Indexers there's no needed change.</P><P>at HF level, you have to apply the process described at&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.0.1/Forwarding/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data_input" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.1/Forwarding/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data_input</A></P><P>Ciao.</P><P>Giuseppe</P> Thu, 08 Sep 2022 13:23:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-forward-specific-event-data-from-HF-to-indexer/m-p/612417#M105970 gcusello 2022-09-08T13:23:01Z