Getting Data In

HF different index names for each target group


I have a Splunk enterprise cluster which also needs to forward some logs to a completely separate Splunk cluster.

I couldn't easily find a way in my heavy forwarder config to sends logs locally to one index and to another index in the remote cluster.

In my outputs.conf I have [tcpout:local] and [tcpout:remote]

My props.conf

TRANSFORMS-routing = remote-routing

And transforms.conf

# route to local Splunk and remote Splunk
FORMAT = local,remote

How can I update this so that locally logs go to a syslog index (the default) and in the remote Splunk they go to an index syslog_xyz?


You'll need to use syslog stanzas in outputs.conf instead of tcp.

Such as this example taken from the documentation:

server =



Though you'll also want to set type = tcp as udp is the default.

0 Karma


@stephenmuss have you been able to find a solution? I'm facing the same challenge.

0 Karma