How to forward specific event data from HF to indexer?

[medtemo]

Hello ALL,
My deployment is UF ---->HF(local copy)----->indexer
I would like to send logs from HF to indexer except some sourcetype,
at the same time need to keep a local event copy of all forwarded logs from
UF in HF.
I have found a number of seemingly great answers and help pages for how to set this up with props.conf and transforms.conf but no luck.

At what level do I need to change configuration HF or Indexer?
please suggest how to achieve this.

Thanks,

[gcusello]

Hi @medtemo,

on Indexers there's no needed change.

at HF level, you have to apply the process described at https://docs.splunk.com/Documentation/Splunk/9.0.1/Forwarding/Routeandfilterdatad#Route_inputs_to_sp...

Ciao.

Giuseppe