We have a requirement to send data from our HF server to Splunk cloud indexers as well as on-premise indexer.
So, Windows index data has to go to only the cloud indexer. The rest of the indexer data goes to the on-premise indexer server.
I have tried to put outputs.conf like this:
But, it's still not woking. It may be tcp_routing will work, so looking for suggestions.