How to forward indexed data that needs to be SSL encrypted to a second indexer?

[jstaley]

Hello,

Looking to forward data from one indexer to a second indexer. The are multiple reasons for the separate indexer and we have definitely looked into a majority of our options for this scenario. With this being said, the information being forwarded to the second indexer needs to be ssl encrypted. How would be go about this?

Thanks

[Ayn · Accepted solution]

You need to do two things:

• Configure your indexer to forward data to another indexer using SSL: http://docs.splunk.com/Documentation/Splunk/6.1.3/Security/Aboutsecuringdatafromforwarders
• Configure your indexer to index as usual and also forward data to the external indexer: http://docs.splunk.com/Documentation/Splunk/6.1.3/Forwarding/Routeandfilterdatad#Use_the_forwardedin...

[jstaley]

Thank you for your reply, it is much appreciated. I am in the process of setting up the labs to check everything over.