Route to Indexer by app

[nickstone]

Im sure there is a straight forward way to do this with Enterprise, however when using Splunk Cloud; what is the best practice for forwarding the output of an app to a different indexer from Splunk Cloud?

Can I configure the app to have its own outputs.conf and not affect the other apps?

Or do I need to add the tcp routing string to the inputs.conf?

[gfuente]

Hello

Do you have an hybrid enviroment?

If you only have Splunk Cloud, then you should send all data to all indexers, so use the default settings that you get with the Forwarder app that you download from you Splunk Cloud instance.

Maybe you are referring to indexes instead of indexers?

Regards

[nickstone]

No I mean Indexers. as in the Splunk instance, not the bucket of data.

No hybrid

I have an Indexer that a special security department needs physically seperated and I need the output of their apps to go to a different Indexer, but I don't want duplicate heavy forwarders

[esix_splunk]

Indexes are physically separated, as in on disk they are separated and in Splunk, you use RBAC to grant access to these indexes.

Is that what you are wanting to do? Or are you wanting to send a second stream of data for specific indexes to a different group of indexers?

[gfuente]

Then, the way to go is setting different outputs groups ,and then input by input define the output group with the tcp routing setting, as you proposed

regards