How to forward events from one indexer to another?

[chanduira]

Hi,

I have two Splunk instances and events are being indexed in one instance (indexer) with index name ABC. I want to forward all events from index ABC to the second instance. Please help, how we can do this?

[somesoni2]

The option "Index and forward" will do the job for you but will cause double Splunk license cost. A better option would be to have clustered indexers. http://docs.splunk.com/Documentation/Splunk/6.1/Indexer/Aboutclusters

[gyslainlatsa]

hi chanduira,

try following this link:

https://answers.splunk.com/answers/203547/index-and-forward-data-into-another-splunk-instanc.html

[chanduira]

Can you help with exact outputs.conf and inputs.conf, document creating confusion around.