https://community.splunk.com/t5/Getting-Data-In/Index-and-Forward-data-into-another-splunk-instance/m-p/150360#M30561 <P>Hi blee2,</P> <P>my approach would be to send this data / events directly to this separate Splunk 6.2 server. If this is not possible for what ever reason; any Splunk instance doing event parsing (Heavy forwarder or Indexer(if no heavy forwarder is in front of it) for example) can do filter and routing. Take a look at the docs <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding">http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding</A></P> <P>this should give a lot of hints how this could be done. BTW an indexer can be a heavy forwarder at the same time <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>cheers, MuS</P> Fri, 12 Dec 2014 20:57:59 GMT MuS 2014-12-12T20:57:59Z https://community.splunk.com/t5/Getting-Data-In/Index-and-Forward-data-into-another-splunk-instance/m-p/150359#M30560 <P>I have an existing splunk instance on run version 6. I want to forward a copy of one data type into another splunk instance on a separate server running 6.2. Is there a way to forward a copy of just a specific index into another instance of the splunk server? </P> <P>Thanks,</P> Fri, 12 Dec 2014 19:01:14 GMT https://community.splunk.com/t5/Getting-Data-In/Index-and-Forward-data-into-another-splunk-instance/m-p/150359#M30560 blee2 2014-12-12T19:01:14Z https://community.splunk.com/t5/Getting-Data-In/Index-and-Forward-data-into-another-splunk-instance/m-p/150360#M30561 <P>Hi blee2,</P> <P>my approach would be to send this data / events directly to this separate Splunk 6.2 server. If this is not possible for what ever reason; any Splunk instance doing event parsing (Heavy forwarder or Indexer(if no heavy forwarder is in front of it) for example) can do filter and routing. Take a look at the docs <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding">http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding</A></P> <P>this should give a lot of hints how this could be done. BTW an indexer can be a heavy forwarder at the same time <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>cheers, MuS</P> Fri, 12 Dec 2014 20:57:59 GMT https://community.splunk.com/t5/Getting-Data-In/Index-and-Forward-data-into-another-splunk-instance/m-p/150360#M30561 MuS 2014-12-12T20:57:59Z https://community.splunk.com/t5/Getting-Data-In/Index-and-Forward-data-into-another-splunk-instance/m-p/150361#M30562 <P>Good place to start, Documentation.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding">http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding</A></P> Fri, 12 Dec 2014 21:09:21 GMT https://community.splunk.com/t5/Getting-Data-In/Index-and-Forward-data-into-another-splunk-instance/m-p/150361#M30562 somesoni2 2014-12-12T21:09:21Z