Forward Data

[Kendo213]

I need to index data from an appliance we have, however in the appliance you can only specify one syslog server. How can I index the data on our central instance and then forward the data on to a separate heavy forwarder?

We basically have two separate Splunk instances so I need to figure out how to get the data to both of them.

[Ayn]

You can route specific events to other Splunk instances, and/or index them locally on the Splunk instances you're routing the events from. See more here: http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Routeandfilterdatad