Requirement: We have certain unique application servers where they would be sending data to the universal forwarder on port 9997. However, once the data comes to the universal forwarder, the data should be sent to two Splunk Indexer machines on different ports and to specific indexes created. So the data coming from application1, application2, application3 servers as example should go and reside on Splunk Indexers machines to their specified Indexes. Here the universal forwarder would be acting as a proxy I can say.
Can anyone please let me know how this could be possible? I would appreciate if proper pointers with examples are provided. Thanks much all.