Hello Splunkers,
Can we forward events from 1 indexer cluster to other indexer cluster??
We are supposed to fetch events from servers store it at our indexer cluster while need to forward it to customers indexers cluster.
Customer doesn't want us to mirror events by using HF.
So can we do same by enabling HF configurations at every Indexers of our cluster?
I think this can be done using configurations provided routing and filter docs. Still need to confirm from experts whether will there be any issues with such approach.
Another aspect is suppose I want any particular event under index A at our indexer and customer needs same event under index B at their side, where we will forward them unindexed and they may index it at their indexers, is this possible?
I'm hoping there won't be any sequencing issues as well when multiple indexers would be forwarding events since timestamp would be appropriate.
We are Ok with 2x of license consumption...may be will drop events at our side the ones which are not needed.
PS: I'm new with Splunk and trying to understand how can we use at best to us and for customer.
