Store specific summary indexes on SH, and forward the rest of indexes on Indexer

[melonman]

Hi

I have 4 summary index generating searches scheduled on my search head,
and I am looking for a configuration that can do the following :

Keep summary1 and summary2 in Search Head Only.
(don't send summary1/2 to indexer)
Keep summary3 and summary4 in indexer Only.
(don't keep summary3/4 in Search Head)

I don't want to do IndexAndForward for summary3 and summary4.

Does anyone know how to configure outputs.conf for this scenario?

Current outputs.conf is below (still trying to find out how to do this)..
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Forward_data_for_a...

[tcpout]
server=idx1:9997,idx2:9997
autoLB = true
indexAndForward=true
forwardedindex.0.whitelist =
forwardedindex.1.blacklist =
forwardedindex.2.whitelist =
forwardedindex.0.whitelist = (summary1|summary2)

Thank you,

[yannK]

you can try to use the tcpout routing with a transforms.
DEST_KEY=_TCP_ROUTING

see http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Forwa...