Hi I seem to have found what I required from https://answers.splunk.com/answers/614054/how-to-index-all-locally-and-forward-specific-sour.html Here we have work around to changing inputs.conf which did not allow us to filter sourcetypes. We are still using Selective Forwarding except now we can divert any specific sourcetype by identifying it in props.conf and giving it a transform in the stanza [<sourcetype>] TRANSFORMS-toindex = selectiveIndex And we define this Transform in transforms.conf [selectiveIndex] REGEX = . DEST_KEY = _INDEX_AND_FORWARD_ROUTING FORMAT = local We also add a stanza to transforms.conf [accepted_keys] is_valid = _INDEX_AND_FORWARD_ROUTING This takes away the invalid key error from the selectedIndex stanza. Now we are Indexing that sourcetype only. The ones that need to be forwarded can be defined as usual when forwarding to 3rd party Indexers (https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Forwarddatatothird-partysystemsd). Since we are using selective Indexing we need to add a stanza to outputs.conf as well [indexAndForward] index = true selectiveIndexing = true ... View more