How to save license usage while Indexing data and forward to another indexer?


alt text

I want to store ALL data received by Group_A.
And just data in 2_a index of Group_A want to transfer to another indexer(Group_B).
Is there a way to save the license usage?
Thank you

Labels (1)
0 Karma


I want to store Group_A and Group_B.

0 Karma

Splunk Employee
Splunk Employee

On a side note, you will get 2 X License hit here. Whatever is indexed on group B will be counted against the License Master.

0 Karma


Is it possible to index at site A and then forward select indexes to site B? Is there some custom replication setting that could make this possible?

0 Karma


Have a look at "Configure selective indexing" on this page:

I believe the data will only hit the license meter one time with the configuration you are looking for.

0 Karma


Not store in Goup_A.
But store in Group_B.
Where's wrong?

Setting Config

  1. inputs.conf
    connection_host = ip
    index = a
    sourcetype = syslog_test
    _TCP_ROUTING = data_out

  2. outputs.conf
    defaultGroup = data_out
    indexAndForward = true



disabled = true

server =

disabled = false
forwardedindex.0.whitelist = a

forwardedindex.1.blacklist = _.*

forwardedindex.2.blacklist = (_audit|_internal|_introspection)

forwardedindex.filter.disable = false
server =

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...