Forward data from one SH to another indexer which are not connected in any away ??

[akhil36109]

I have a search head - COB
i have two indexers connected to it - Ind1 and Ind2

and I have another indexer MBS01 which doesnt have any connection with above SH and Indexers.

Now i want to run a query which gives me some required fields as results in COB
for example say device_name, device_Id, cust_name, cust_ID

now i want this results sent into MBS01 indexer into a summary index called "OPS_index"which doesnt have any connection to "COB SH".

Note: Now after sending d required fields to MBS01 and storing them into summaryindex="OPS_index" , I want to run a ML prediction query in MBS01 on this summary index.

QUESTIONS:

1.Can i install UF in COB and export the results as csv and using UF can i send to summaryindex="OPS_Index" in MBS01??
so if i do use UF wil it get re-indexed again in MBS01 ??
so if its re-indexed can i run the ML PREDICTION query ??

is there any other way to forward results from COB SH to MBS01 ??

[starcher]

You could use an alert action to send the search results to a HTTP Event Collector for the other indexer. https://splunkbase.splunk.com/app/3508/

[DUThibault]

You could have a UF on COB working on behalf of MBS01, it would merely need to watch some file, which could be updated by a script on COB. Seems a roundabout way of doing things, however.

[HiroshiSatoh]

Is this helpful?

http://docs.splunk.com/Documentation/Splunk/6.5.0/Forwarding/Routeandfilterdatad#Perform_selective_i...