outputs.conf direct to indexer based on index

[rtadams89]

I'd like to install the LFC on several hosts have them forward data to one of two indexers based on the index the data is tied to. For example, if the host is forwarding data destined for index A and index B, I want those events destined for index A to only be forwarded to Indexer A and those events destined for index B to only be forwarded to Indexer B.

Is this possible? How do I need to configure outputs.conf on the LFC to make it happen?

[kristian_kolb · Accepted solution]

I don't know what an LFC is, but this section of the docs describe routing of events to different indexers. And it requires a Heavy Forwarder, not the Universal or Lightweight Forwarder.

http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

/k