Is it possible to have 1 forwarder forward data to 2 different groups of indexer clusters?

[sympatiko]

Hi splunkers,

Good day! I just want to ask some opinion what is the best way I can do or is it possible to achieve this:

I have 1 forwarder, forwarding the data to my indexer cluster rf=3 and sf=3. I'm planning to add two new indexers peering together to index different stuff. I want this forwarder to forward the data to this new group of indexers for this different purpose.

apachelogs ---> Forwarder ----> indexer cluster1
systemlogs ---> Forwarder -----> indexer cluster2

Thanks

[baerts]

Hi sympatiko!

Probably tcp_routing can establish this. There are some good answers on this site on how to establish this