Can I create an index locally and have it selectively forward specific fields from a source?

[sail4lot]

Hi all- I have a unique requirement/question, I think.

I'm wondering if there is a way in Splunk to set up a heavy forwarder as an indexer (so that we can search it locally) and also forward that data home. However, the unique part of this is that I want to specify which fields from a certain index get forwarded. For example, I want to search all the data (for the purpose of this example - containing fields A-Z) ingested and indexed locally, but when I send it to on to another indexer, already cooked, I only want to send fields A, B, C, D from that.

Any ideas?

Thanks.

[micahkemp · Accepted solution]

You don't forward field. You forward events. Everything indexed in Splunk is an event.

If you want to change the format of the event to only include fields you want, you could use a savedsearch to table the fields you want and summary index that. But that would be done on a scheduled basis, not at index time.

[sail4lot]

OK Yeah perfect. That's basically where I ended up with it all after doing a bunch of research. Thanks!

[woodcock]

Yes, do it like this:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Admin/Outputsconf#IndexAndForward_Processor

[sail4lot]

I'm not sure I see where you can specify which fields you want to forward in a given event. I see that you can forward specific events by whitelist or blacklist but not portions of them.