Getting Data In

How to forward data from an indexer to a specific index in another indexer?

ebailey
Communicator

We are forwarding data from an indexer in a remote data center to our primary indexer with no issues. What I would like to do next is forward that data to a specific index in the primary indexer. Is this possible? Thanks!

Tags (3)
0 Karma

merp96
Path Finder

Hi,

You could add the below route settings in the inputs.conf of the Primary Index and then use props and transforms to override and set the index for all incoming events.

[splunktcp://1111]
route=has_key:_utf8:parsingQueue;has_key:_linebreaker:parsingQueue;absent_key:_utf8:parsingQueue;absent_key:_linebreaker:parsingQueue

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...