We have 2 sets of Indexers in our environment. Set-1 has 29 indexers and Set-2 has 5 indexers.
All the data comes to Set-1 indexers through 16 Heavy Forwarders. This data includes capacity planning data (say with index = cpd). All the capacity data should also be available on Set-2 indexers. Though we can route the capacity planning data directly to the two sets on Indexers, we do not want to do that because it will consume the license twice.
So we want all the data to be indexed in Set-1 indexers. After the data gets indexed, we want to replicate just the data in index=cpd (capacity planning data) to Set-2 indexers. Once the data replicates to Set-2 indexers it should not be indexed again (license concern)
In short, we want to have a copy of a particular index's data (which is available on Set-1 indexers) on Set-2 indexers.
I have gone through splunk docs and splunk answers, but did not find the answer I am looking for.
Could someone help me in getting solution for this issue? Thanks in advance.
... View more