Getting Data In

Configure selective indexing to send all logs to a dev indexer

Contributor

i am bit lost on selective indexing. I wanted to configure on of my prod indexers to send logs to a dev indexer and after reading up on some documents i feel i am missing something. below would be the config i would apply anyone have tips on what i am missing?

-Prod indexer-
outsputs.conf-
[indexAndForward]
index=true
selectiveIndexing=true

[tcpout:sendtodev]
server = dev_indexer:9997

-inputs.conf-
add INDEXANDFORWARDROUTING=sendtodev to all inputs.conf stanzas on the prod indexer.

-Dev indexer inputs.conf-
add a inputs.conf stanza that will listen for prod_index:9997

0 Karma
1 Solution

Motivator

Try this article.

To send data to a separate indexer or set of indexers, you will need to use the TCPROUTING setting in inputs.conf

http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Routeandfilterdatad

View solution in original post

0 Karma

Motivator

Try this article.

To send data to a separate indexer or set of indexers, you will need to use the TCPROUTING setting in inputs.conf

http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Routeandfilterdatad

View solution in original post

0 Karma