Can you help me set up our heavy forwarder for the following event filtering necessities?

[farooqm]

Hello,

Can someone please direct me to the Splunk docs tutorial, or any video, that would show me how to use the heavy forwarder?

I have a sample event, lets say 5 fields. I want 2 fields to go to the Indexer. I do care about routing as I just want these two fields to stay together in the same index whenever they go.

Can someone show me an example of how to configure this in the heavy forwarder?

[richgalloway]

All fields within the same event always stay together. Routing affects events rather than fields.

To learn about the heavy forwarder, start with the Forwarding Data manual (http://docs.splunk.com/Documentation/Splunk/7.2.1/Forwarding/Aboutforwardingandreceivingdata).

To learn about routing events, see the "Route and filter data" section in the same manual.