Greetz,
We have two summary indexes we would like to forward, so on Splunk 5.0.3:
[tcpout]
indexAndForward = true
defaultGroup = Client1, Client2
maxQueueSize = 7MB
useACK = true
# RTFM says below to disable defaults:
forwardedindex.0.whitelist =
forwardedindex.1.blacklist =
forwardedindex.2.whitelist =
# Then custom.
forwardedindex.0.blacklist = .*
forwardedindex.1.whitelist = .*_ext_summary
[tcpout:Client1]
server = 172.nn.nn.nn:9997
[tcpout:Client2]
server = 172.nn.nn.nn:9997
As per RTFM, whitelisting only allowed in top stanza.
At the moment, both groups get all forwarded summary indexes which is not what we want.
Is it possible to TCP route via a group for a whitelisted forwardedindex?
I have done _TCP_ROUTING for an input but don't see anything for an index?
We want to send client1_ext_summary out via Client1 group and client2_ext_summary out via Client2 group.
Thank you.
