Configure selective indexing to send all logs to a dev indexer

[sbattista09]

i am bit lost on selective indexing. I wanted to configure on of my prod indexers to send logs to a dev indexer and after reading up on some documents i feel i am missing something. below would be the config i would apply anyone have tips on what i am missing?

-Prod indexer-
outsputs.conf-
[indexAndForward]
index=true
selectiveIndexing=true

[tcpout:send_to_dev]
server = dev_indexer:9997

-inputs.conf-
add _INDEX_AND_FORWARD_ROUTING=send_to_dev to all inputs.conf stanzas on the prod indexer.

-Dev indexer inputs.conf-
add a inputs.conf stanza that will listen for prod_index:9997

[tmarlette · Accepted solution]

Try this article.

To send data to a separate indexer or set of indexers, you will need to use the _TCP_ROUTING setting in inputs.conf

http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Routeandfilterdatad