Knowledge Management
Highlighted

Store specific summary indexes on SH, and forward the rest of indexes on Indexer

Motivator

Hi

I have 4 summary index generating searches scheduled on my search head,
and I am looking for a configuration that can do the following :

Keep summary1 and summary2 in Search Head Only.
(don't send summary1/2 to indexer)
Keep summary3 and summary4 in indexer Only.
(don't keep summary3/4 in Search Head)

I don't want to do IndexAndForward for summary3 and summary4.

Does anyone know how to configure outputs.conf for this scenario?

Current outputs.conf is below (still trying to find out how to do this)..
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Forward_data_for_a...

[tcpout]
server=idx1:9997,idx2:9997
autoLB = true
indexAndForward=true
forwardedindex.0.whitelist =
forwardedindex.1.blacklist =
forwardedindex.2.whitelist =
forwardedindex.0.whitelist = (summary1|summary2)

Thank you,

0 Karma
Highlighted

Re: Store specific summary indexes on SH, and forward the rest of indexes on Indexer

Splunk Employee
Splunk Employee

you can try to use the tcpout routing with a transforms.
DESTKEY=TCP_ROUTING

see http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Forwa...

0 Karma