Is there a way to make forwarding/indexing decisions in Splunk config files based on the sending Splunk server regardless of the contents event data? Background: We have several Splunk servers (lets call them, A,B,C,D,E). Each server receives logs from several hosts and sources. We are need to forward data based on what Splunk server (not the host, source, or sourcetype) sent the logs. For example: Splunk servers A, B and C forward their logs to Splunk server D. If Splunk server D received data from Splunk server C, Splunk server D must index+forward the data to Splunk server E (regardless of the event details). Splunk server D will only index, and not forward, logs forwarded from Splunk servers A and B. Please note: Clustering is not an option in our environment Thank you for any feedback ... View more