Il would like to know if i could forward data based on sourcetype between 2 indexers or between indexer and search head.
Il would like to forward only data of a certain sourcetype.
Thank you for your help
I have multiple indexers and one search head.
forwarders => Indexer 1, Indexer 2, Indexer N => search head => forwarding to third party
I can forward data but the problem is that is forwarding all the data.
Il would like to index all data locally to indexer and forward only data based on certain sourcetype by the search head to avoid open additional port between indexers and the third party software.
I have tested by configuring props.conf, transforms.conf and outputs.conf, but still forwarding all data, all sourcetype.
Thanks a lot for your help
Here is my conf of an indexer to forward to search head and from search i would like to forward to third party.
The problem is not only data of soucetype "mysourcetype" is forwarded but all data.
TRANSFORMS-routing = forward_to_my_search_head_from_indexer
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = my_search_head_group
defaultGroup = nothing
indexAndForward = true
disable = false
server = my_search_head_ip:9997
sendCookedData = false
Thank you for yo
Please say more about that. Why the SH and not the indexer where the data resides? What third-party software)?
I think your defaultGroup attribute needs a value that is not "my_search_head_group".
Have you read https://docs.splunk.com/Documentation/Splunk/8.0.5/Forwarding/Forwarddatatothird-partysystemsd?