https://community.splunk.com/t5/Getting-Data-In/splunk-to-forward-1-index-only/m-p/251752#M48460 <P>Hello everyone : ) </P> <P>I have a splunk instance with an alert manager app that is producing logs that are being indexed on the same machine as index=alerts. <BR /> I would like to forward this data to another splunk instance, without use an universal forwarder, but only changing the outputs.conf file in splunk. </P> <P>Using this system, I m forwarding ALL the logs are contains in my splunk istance to the other one, but I would like to send only index=alerts. </P> <P>How can I change the inputs/outputs.conf to allow this? </P> <P>Thanks, <BR /> Federica</P> Thu, 26 Nov 2015 15:19:42 GMT Federica_92 2015-11-26T15:19:42Z https://community.splunk.com/t5/Getting-Data-In/splunk-to-forward-1-index-only/m-p/251752#M48460 <P>Hello everyone : ) </P> <P>I have a splunk instance with an alert manager app that is producing logs that are being indexed on the same machine as index=alerts. <BR /> I would like to forward this data to another splunk instance, without use an universal forwarder, but only changing the outputs.conf file in splunk. </P> <P>Using this system, I m forwarding ALL the logs are contains in my splunk istance to the other one, but I would like to send only index=alerts. </P> <P>How can I change the inputs/outputs.conf to allow this? </P> <P>Thanks, <BR /> Federica</P> Thu, 26 Nov 2015 15:19:42 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-to-forward-1-index-only/m-p/251752#M48460 Federica_92 2015-11-26T15:19:42Z https://community.splunk.com/t5/Getting-Data-In/splunk-to-forward-1-index-only/m-p/251753#M48461 <P>Look at this link:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Forward_data_for_a_single_index_only">http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Forward_data_for_a_single_index_only</A></P> <P>Outputs.conf: in “$splunkhome$/etc/system/local/outputs.conf<BR /> <STRONG><EM>Something like what is below:</EM></STRONG><BR /> [tcpout]<BR /> defaultGroup = local<BR /> indexAndForward=true<BR /> forwardedindex.0.whitelist = .*<BR /> forwardedindex.1.blacklist = _.*<BR /> forwardedindex.2.whitelist = alerts</P> <P><EM>[tcpout:whatever]</EM> -- Whatever it is set to now should work if it is already forwarding everything.</P> Wed, 23 Dec 2015 20:00:58 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-to-forward-1-index-only/m-p/251753#M48461 dcharboneau_spl 2015-12-23T20:00:58Z