How to save license usage while Indexing data and forward to another indexer?

[khyoung7410]

I want to store ALL data received by Group_A.
And just data in 2_a index of Group_A want to transfer to another indexer(Group_B).
Is there a way to save the license usage?
Thank you

[khyoung7410]

I want to store Group_A and Group_B.

[esix_splunk]

On a side note, you will get 2 X License hit here. Whatever is indexed on group B will be counted against the License Master.

[dflodstrom]

Is it possible to index at site A and then forward select indexes to site B? Is there some custom replication setting that could make this possible?

[dflodstrom]

Have a look at "Configure selective indexing" on this page:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Perform_selective_i...

I believe the data will only hit the license meter one time with the configuration you are looking for.

[khyoung7410]

Not store in Goup_A.
But store in Group_B.
Where's wrong?

Setting Config

1. inputs.conf
   [udp://515]
   connection_host = ip
   index = a
   sourcetype = syslog_test
   _INDEX_AND_FORWARD_ROUTING=local
   _TCP_ROUTING = data_out

2. outputs.conf
   [tcpout]
   defaultGroup = data_out
   indexAndForward = true

[indexAndForward]
index=true
selectiveIndexing=true

[tcpout:null]

disabled = true

server = 1.1.1.1:1000

[tcpout:data_out]
disabled = false
forwardedindex.0.whitelist = a

forwardedindex.1.blacklist = _.*

forwardedindex.2.blacklist = (_audit|_internal|_introspection)

forwardedindex.filter.disable = false
server = 192.168.18.136:9090