I have two standalone Splunk instances, Splunk A and Splunk B. Splunk A has a scripted input that runs on a cron schedule and indexes results. What I am trying to do is have Splunk A send that same data to Splunk B so that it is indexed again (yes I know it's redundant and doubles license usage).
I have studied examples here https://docs.splunk.com/Documentation/Splunk/8.0.4/Forwarding/Routeandfilterdatad and have managed to get half way: Splunk A sends the data to Splunk B where it is indexed, but does not index the data itself. Here are my config files:
What am I missing so that Splunk A will index the events as well as forward them to Splunk B?