Getting Data In

Can you disable indexing for a heavy forwarder and use it only for parsing data?

fstsantos
Engager

Is it possible to disable all indexing operations in a heavy forwarder and use it exclusively for data parsing?

I need to transform the data and forward it to another splunk instance, without any indexing in the forwarder.

Thanks

Tags (1)
1 Solution

strive
Influencer

By default it wont index. Unless you set it true.

indexAndForward = [true|false]  
* Index all data locally, in addition to forwarding it.  
* This is known as an "index-and-forward" configuration.  
* This attribute is only available for heavy forwarders.  
* This attribute is available only at the top level [tcpout] stanza. It cannot be overridden in a target group.  
* Defaults to false.

View solution in original post

strive
Influencer

By default it wont index. Unless you set it true.

indexAndForward = [true|false]  
* Index all data locally, in addition to forwarding it.  
* This is known as an "index-and-forward" configuration.  
* This attribute is only available for heavy forwarders.  
* This attribute is available only at the top level [tcpout] stanza. It cannot be overridden in a target group.  
* Defaults to false.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...