I want to store ALL data received by Group_A.
And just data in 2_a index of Group_A want to transfer to another indexer(Group_B).
Is there a way to save the license usage?
Thank you
I want to store Group_A and Group_B.
On a side note, you will get 2 X License hit here. Whatever is indexed on group B will be counted against the License Master.
Is it possible to index at site A and then forward select indexes to site B? Is there some custom replication setting that could make this possible?
Have a look at "Configure selective indexing" on this page:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_i...
I believe the data will only hit the license meter one time with the configuration you are looking for.
Not store in Goup_A.
But store in Group_B.
Where's wrong?
inputs.conf
[udp://515]
connection_host = ip
index = a
sourcetype = syslog_test
_INDEX_AND_FORWARD_ROUTING=local
_TCP_ROUTING = data_out
outputs.conf
[tcpout]
defaultGroup = data_out
indexAndForward = true
[indexAndForward]
index=true
selectiveIndexing=true
[tcpout:data_out]
disabled = false
forwardedindex.0.whitelist = a
forwardedindex.filter.disable = false
server = 192.168.18.136:9090