Prevent forwarder from re forwarding

[nicolasbussiere]

We have data being forwarded (heavy forwarder) to a spunk server 1 , and we also forward (heavy forwarder) from that splunk server 1 to an other splunk server 2.

Is there a way to filter out forwarded messages so messages forwarded to server 1 are not sent to server 2 ?

Thanks for any hints !

[renjith_nair]

Do you mean to say splunk server1 is an indexer too?

Anyway try this link to filter or route your data

http://docs.splunk.com/Documentation/Splunk/6.3.1511/Forwarding/Routeandfilterdatad

[renjith_nair]

Let me know if it helped!