How to edit my heavy forwarder tcpout configuration to forward a specified index to a clone group of indexers?

[andrey2007]

Hello all,

I have a Heavy Forwarder which forwards some indexes to specified indexers group.
Now I would like to forward a specified index to another group of indexers.
My tcpout.conf looks like this, but I have all indexes forwarded to clone group.

Does anyone have any ideas?

[tcpout]
maxQueueSize = auto
forwardedindex.0.whitelist = test_ind
forwardedindex.0.whitelist = _audit
forwardedindex.filter.disable = false
indexAndForward = true
autoLBFrequency = 30
blockOnCloning = true
compressed = false
disabled = false
dropClonedEventsOnQueueFull = 5
dropEventsOnQueueFull = -1
heartbeatFrequency = 30
maxFailuresPerInterval = 2
secsInFailureInterval = 1
maxConnectionsPerIndexer = 2
forceTimebasedAutoLB = false
sendCookedData = true
connectionTimeout = 20 
readTimeout = 300
writeTimeout = 300 
useACK = true
blockWarnThreshold = 100
sslQuietShutdown = false
defaultGroup=indexer1, indexer2

[tcpout:indexer1]
server=sp-idx1:9997

[tcpout:indexer2] //clone group
forwardedindex.0.whitelist = test_ind
forwardedindex.1.blacklist = .*
forwardedindex.filter.disable = false
server=sp-idx2:9997

[andrey2007 · Accepted solution]

I made it this way
http://answers.splunk.com/answers/224060/cloning-set-of-data-to-specified-splunk-indexer.html#answer...