Thank you.   ... View more

Perfect, just to fast-track the process of getting service KPI ids we can use "service_kpi_lookup" to find kpi_id and directly search using that id in saved searches to spot KPI base search. | inputlookup service_kpi_lookup | search title="your_service_name"   ... View more

Hi @richgalloway , Thanks for extending a hand of help on this. Earlier I had added only [tcpout:PT01] stanza with server details in outputs.conf which ended up sending all the data to PT01 and nothing was indexed locally on TEST01 (Expected). To counter this I went ahead and tried configs like this Filter and route event data to target groups editing props, transforms & outputs which added some absurd behavior, like when trying to restart it was timing out trying to stop and I had to start manually. On exploring more about routing I found Perform selective indexing and forwarding was the exact kind of behavior I was looking up to implement. So I edited the inputs & outputs files on TEST01 as below. ---------- inputs.conf ---------- [default] host=test01 [batch:///opt/splunk/data/Test] index=main sourcetype=testing-kvp move_policy=sinkhole _INDEX_AND_FORWARD_ROUTING=local [batch:///opt/splunk/data/Test2PT] index=main sourcetype=testing2pt-kvp move_policy=sinkhole _TCP_ROUTING=pt01 ---------- outputs.conf ---------- [tcpout] defaultGroup=noforward disabled=false [indexAndForward] index=true selectiveIndexing=true [tcpout:pt01] server=PT01:9997 This move solved my requirement, that is indexed data locally on TEST01 and forward some data to PT01 as well but raised a new set of problems. As mentioned our TEST01 is a standalone Splunk Enterprise installation, it has data being forwarded to it from UF on other hosts, scripted inputs, rest endpoints, etc. data inputs are configured which gets indexed daily over it. After adding this configuration all other data inputs apart from the one's mentioned in inputs.conf stopped indexing totally. Can I get some help to reach the end as on how I can index literally all the data on TEST01 locally and just monitor forward files from one folder, in this case "/opt/splunk/data/Test2PT" to PT01 ? ... View more

Thank you @gcusello! that helped a lot. ... View more

Hi @gcusello  I was looking for how I can configure One UF to send data to Two Indexer Groups which are setup in different environment. ... View more