Getting Data In

Can you help me set up our heavy forwarder for the following event filtering necessities?

New Member


Can someone please direct me to the Splunk docs tutorial, or any video, that would show me how to use the heavy forwarder?

I have a sample event, lets say 5 fields. I want 2 fields to go to the Indexer. I do care about routing as I just want these two fields to stay together in the same index whenever they go.

Can someone show me an example of how to configure this in the heavy forwarder?

0 Karma


All fields within the same event always stay together. Routing affects events rather than fields.

To learn about the heavy forwarder, start with the Forwarding Data manual (

To learn about routing events, see the "Route and filter data" section in the same manual.

If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!