I'd like to send a sample of my prod data to a test env.
Is this possible ?
for example my prod data from one sourcetype contains 100 servers (1-100) which are coming in via HEC on a HWF to prod
I'd like to send hosts 1 - 4 eg : ^server\s[1-4] to the test env as well
There are a couple of ways to do this. If your test environment and prod environment are just different indexes in the same Splunk environment, you can use a search for your hosts along with the collect command. This is a popular technique for summary indexing. If your test and prod environments are completely separate, you will want to look at indexing and forwarding -> http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Perform_selective_...