Why is scripted input not forwarding to peers ?

[tdiestel]

Our setup comprises of 1 heavy forwarder, 3 searchheads and 3 peers/indexers all in the clustered environment.
We are trying to create a scripted input on the heavy forwarder. We need the scripted input to output the data on an index on the peered cluster. When we try to create the scripted input on the heavy forwarder via the UI only the local indexes on the heavy forwarder show up.

How can we achieve our main objective without storing data on the heavy forwarder and only storing it in on the indexers.

[Yasaswy]

Hi,
If there is no need/requirement for local indexing, it can be disabled:

Go to Splunk install directory
cd bin
./splunk disable local-index
./splunk restart 

You can explicitly define your data inputs in your inputs and outputs.conf. Assuming it's a Linux env and you are using default ports..Eg:

inputs.conf  
[script:///Path to your script]
disabled = false
interval = your_interval (cron or secs)
sourcetype = your_sourcetype
index = your_index_on_cluster

outputs.conf
[indexAndForward]
index = false

[tcpout]
defaultGroup = your-group

[tcpout:your-group]
server=idx1:9997,idx2:9997,idx3:9997