Getting Data In

Can you help me send data to cloud as well on-premise servers?


We have a requirement to send data from our HF server to Splunk cloud indexers as well as on-premise indexer.

So, Windows index data has to go to only the cloud indexer. The rest of the indexer data goes to the on-premise indexer server.

I have tried to put outputs.conf like this:

forrwardedindex.1.blacklist= windows

forrwardedindex.1.whitelist= windows

But, it's still not woking. It may be tcp_routing will work, so looking for suggestions.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!