I would like to not send certain indexes from on splunk server to another.
eg On Heavy indexer i have indexA, indexB, and indexC for separate logging devices. I would only like to forward indexA and IndexB to another splunk indexer.
I believe i would need to modify outputs.conf using forwardedindex.0.whitelist = .* and forwardedindex.1.blacklist = _.*
but not sure how to configure it for the above example
Hey, from what the docs give, it should work like this:
forwardedindex.0.blacklist = .*
forwardedindex.1.whitelist = (?:indexA|indexB)
However, better test it, because the docs are a little imprecise on that.