Knowledge Management

Store specific summary indexes on SH, and forward the rest of indexes on Indexer



I have 4 summary index generating searches scheduled on my search head,
and I am looking for a configuration that can do the following :

Keep summary1 and summary2 in Search Head Only.
(don't send summary1/2 to indexer)
Keep summary3 and summary4 in indexer Only.
(don't keep summary3/4 in Search Head)

I don't want to do IndexAndForward for summary3 and summary4.

Does anyone know how to configure outputs.conf for this scenario?

Current outputs.conf is below (still trying to find out how to do this)..

autoLB = true
forwardedindex.0.whitelist =
forwardedindex.1.blacklist =
forwardedindex.2.whitelist =
forwardedindex.0.whitelist = (summary1|summary2)

Thank you,

0 Karma

Splunk Employee
Splunk Employee

you can try to use the tcpout routing with a transforms.


0 Karma