https://community.splunk.com/t5/Getting-Data-In/Indexing-some-and-forwarding-some-on-a-full-Splunk-instance/m-p/268546#M51501 <P>Hello, </P> <P>I have a Splunk instance that is a search head and an indexer. </P> <P>I would like this Splunk instance to index everything exception data of sourcetype=otherDepartmentData. </P> <P>For sourcetype of otherDepartmentData, it will not be indexed locally but will forwarded to another indexer. No other data will be forwarded out. </P> <P>It is not clear to me in the Splunk documentation how this can be configured. </P> <P>Thanks. </P> <P>Cheers,<BR /> Jack</P> Sun, 27 Mar 2016 17:27:58 GMT fhjfong 2016-03-27T17:27:58Z https://community.splunk.com/t5/Getting-Data-In/Indexing-some-and-forwarding-some-on-a-full-Splunk-instance/m-p/268546#M51501 <P>Hello, </P> <P>I have a Splunk instance that is a search head and an indexer. </P> <P>I would like this Splunk instance to index everything exception data of sourcetype=otherDepartmentData. </P> <P>For sourcetype of otherDepartmentData, it will not be indexed locally but will forwarded to another indexer. No other data will be forwarded out. </P> <P>It is not clear to me in the Splunk documentation how this can be configured. </P> <P>Thanks. </P> <P>Cheers,<BR /> Jack</P> Sun, 27 Mar 2016 17:27:58 GMT https://community.splunk.com/t5/Getting-Data-In/Indexing-some-and-forwarding-some-on-a-full-Splunk-instance/m-p/268546#M51501 fhjfong 2016-03-27T17:27:58Z https://community.splunk.com/t5/Getting-Data-In/Indexing-some-and-forwarding-some-on-a-full-Splunk-instance/m-p/268547#M51502 <P>Did you get a chance look at this?<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding">http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding</A></P> Sun, 27 Mar 2016 22:03:50 GMT https://community.splunk.com/t5/Getting-Data-In/Indexing-some-and-forwarding-some-on-a-full-Splunk-instance/m-p/268547#M51502 somesoni2 2016-03-27T22:03:50Z https://community.splunk.com/t5/Getting-Data-In/Indexing-some-and-forwarding-some-on-a-full-Splunk-instance/m-p/268548#M51503 <P>Check this out -- seems to be very similar to what you're doing. I've implemented it and it works, certainly not intuitive. The big issue i'm observing now is that if the indexer can't forward events its target, it simply stops indexing EVERYTHING. <A href="https://answers.splunk.com/answers/371297/how-to-route-locally-indexed-events-from-the-persp.html#answer-373023">https://answers.splunk.com/answers/371297/how-to-route-locally-indexed-events-from-the-persp.html#answer-373023</A></P> Mon, 28 Mar 2016 19:00:25 GMT https://community.splunk.com/t5/Getting-Data-In/Indexing-some-and-forwarding-some-on-a-full-Splunk-instance/m-p/268548#M51503 w531t4 2016-03-28T19:00:25Z