I have to forward the data from my single instance indexer to another system i.e indexer and third party system.
I have tried the below configuration but I am receiving only the local system data i.e /var/log/cron as mentioned in input, how can I get the all hosts file that I configured on my index system.
i .e log files of system1 ,system 2 etc.
[root@splunkvm]# cd /opt/splunk/etc/system/local
[root@splunkvm local]# cat inputs.conf
[splunktcp://9997]
connection_host = ip
[monitor:///var/log/cron]
disabled = false
#_INDEX_AND_FORWARD_ROUTING=local
index = index2
sourcetype = linux_logs
_TCP_ROUTING = indexer
[root@splunkvm local]# cat props.conf
[source::/var/log/cron]
TRANSFORMS-routing=indexer
[root@splunkvm local]# cat transforms.conf
[indexer]
REGEX= .
DEST_KEY=_TCP_ROUTING
FORMAT=thirdindexer
[root@splunkvm local]# cat outputs.conf
[tcpout]
indexAndForward = 1
[tcpout:thirdindexer]
server = 192.168.x.x:9997
[root@splunkvm local]#
