Getting Data In

Indexing some and forwarding some on a full Splunk instance

New Member


I have a Splunk instance that is a search head and an indexer.

I would like this Splunk instance to index everything exception data of sourcetype=otherDepartmentData.

For sourcetype of otherDepartmentData, it will not be indexed locally but will forwarded to another indexer. No other data will be forwarded out.

It is not clear to me in the Splunk documentation how this can be configured.



0 Karma

Path Finder

Check this out -- seems to be very similar to what you're doing. I've implemented it and it works, certainly not intuitive. The big issue i'm observing now is that if the indexer can't forward events its target, it simply stops indexing EVERYTHING.

Revered Legend
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!