Forwarding indexes from one splunk server to another splunk server but filtering out certain indexes

New Member

I would like to not send certain indexes from on splunk server to another.

eg On Heavy indexer i have indexA, indexB, and indexC for separate logging devices. I would only like to forward indexA and IndexB to another splunk indexer.

I believe i would need to modify outputs.conf using forwardedindex.0.whitelist = .* and forwardedindex.1.blacklist = _.*
but not sure how to configure it for the above example


Tags (1)
0 Karma


Hey, from what the docs give, it should work like this:

forwardedindex.0.blacklist = .*
forwardedindex.1.whitelist = (?:indexA|indexB)

However, better test it, because the docs are a little imprecise on that.

0 Karma