How do I forward specific Splunk 5.x indexes to Splunk 6.x?

[JSkier]

I'm trying to forward specific indexes to a test splunk box with the latest version. So, I set forwarding defaults to keep indexing on v5. Configured a TCP port and set v5 to forward to v6, and I get everything (as expected) as noted by the plethora of index missing errors on v6. How do I only send the indexes I specifically want to v6?

I found a few very old answers (v1/2) on splunk core and this older documentation that seems to somewhat address what I'm trying to do, but I still get everything sent to v6 after whitelisting what I want: http://docs.splunk.com/Documentation/Splunk/4.3.3/Deploy/Routeandfilterdatad#Filter_data_by_target_i...

To be clear, I don't want to copy files or buckets over; I want the old version to keep indexing while adding the new data to the new version for testing.

I am very comfortable in Linux, but a bit spotty with splunk itself. Any help is much appreciated!

[martin_mueller]

Take a look at http://docs.splunk.com/Documentation/Splunk/5.0/Admin/outputsconf - search for whitelist.

[JSkier]

Tried restarting the forwarder and splunk service, still sending all logs.

[martin_mueller]

Restarted the forwarding Splunk?

[JSkier]

Still getting other events forwarded. I white listed one index and blacklisted a wild card (*).

[JSkier]

Looks like the correct file to use is $SPLUNK_HOME/etc/system/local/. Haven't recieved anything yet, I'll let it sit. I did have to add the white list line again after adding the forward data back on.