Can someone please direct me to the Splunk docs tutorial, or any video, that would show me how to use the heavy forwarder?
I have a sample event, lets say 5 fields. I want 2 fields to go to the Indexer. I do care about routing as I just want these two fields to stay together in the same index whenever they go.
Can someone show me an example of how to configure this in the heavy forwarder?
All fields within the same event always stay together. Routing affects events rather than fields.
To learn about the heavy forwarder, start with the Forwarding Data manual (http://docs.splunk.com/Documentation/Splunk/7.2.1/Forwarding/Aboutforwardingandreceivingdata).
To learn about routing events, see the "Route and filter data" section in the same manual.