Indexing some and forwarding some on a full Splunk instance

[fhjfong]

Hello,

I have a Splunk instance that is a search head and an indexer.

I would like this Splunk instance to index everything exception data of sourcetype=otherDepartmentData.

For sourcetype of otherDepartmentData, it will not be indexed locally but will forwarded to another indexer. No other data will be forwarded out.

It is not clear to me in the Splunk documentation how this can be configured.

Thanks.

Cheers,
Jack

[w531t4]

Check this out -- seems to be very similar to what you're doing. I've implemented it and it works, certainly not intuitive. The big issue i'm observing now is that if the indexer can't forward events its target, it simply stops indexing EVERYTHING. https://answers.splunk.com/answers/371297/how-to-route-locally-indexed-events-from-the-persp.html#an...

[somesoni2]

Did you get a chance look at this?
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Perform_selective_...