Forward data without effecting ingest volume

[dloszews]

Hello,

We have one universal forwarder, and two cloud instances.   Currently I have all data going to 1 indexer, I've been attempting to determine the most efficient way to parse and route the data so that it will go to the correct indexer/splunk instance without effecting ingest volume.   If I ingest everything into the "primary" indexer can I just parse and route that raw data to the "secondary" indexer without effecting ingest volume on the "primary"? 

I was originally going to use a heavy forwarder for the parsing and routing but sounds like that may be more network IO intensive.  

[gcusello]

Hi @dloszews,

if you index a log before in an Indexer and then in another one (also in Cloud), you ingest this log twice and pay twice the license!

For this reason the correct option is to use an Heavy Forwarder that has all the features of an Indexer but it doesn't index data so you don't pay it twice.

I don't understand what you mean that using an HF is more Network intensive, it's the same thing because you're sending the same data from primary (Indexer or HF) to the Cloud.

Ciao.

Giuseppe