Getting Data In

Can you help me set up our heavy forwarder for the following event filtering necessities?

New Member


Can someone please direct me to the Splunk docs tutorial, or any video, that would show me how to use the heavy forwarder?

I have a sample event, lets say 5 fields. I want 2 fields to go to the Indexer. I do care about routing as I just want these two fields to stay together in the same index whenever they go.

Can someone show me an example of how to configure this in the heavy forwarder?

0 Karma


All fields within the same event always stay together. Routing affects events rather than fields.

To learn about the heavy forwarder, start with the Forwarding Data manual (

To learn about routing events, see the "Route and filter data" section in the same manual.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...