Hello splunkers, i need to understand the best way to forward my data in multisite indexer cluster for Disaster Recovery management: For example, we have: On Site A 1 manager node (active) 3 peer nodes [IDX_1A, IDX_2A, IDX_3A ] (active) 1 search head (active) 2 Heavy Forwarder [HF_1A, HF_2A] (active) On Site B 1 manager node (stand by) 3 peer nodes [IDX_1B, IDX_2B, IDX_3B ] (active) 1 search head (stand by) 2 Heavy Forwarder [HF_1B, HF_2B] (standy By) On HF_1A and HF_2A the outputs.conf have to configure to send data to: 1) ALL site A and site B indexers (IDX_1A, IDX_2A, IDX_3A, IDX_1B, IDX_2B, IDX_3B) we suppose that HF can comunicate with all OR 2) Only site A IDX? (IDX_1A, IDX_2A, IDX_3A) OR 3) Any other way? Thanks in advance ... View more