I inherited an old splunk environment where all data was indexed into the main index. I have setup a new environment with multiple indexes and some parsing rules on a heavy forwarder (These configs work perfectly with the universal forwarders I have deployed).  How would I forward the data from the original main index, into the heavy forwarder for redistribution into the new indexes? ... View more

I am building a new Splunk environment, and due to the number of clients we have, we are building a simple distributed environment that consists of 1 Heavy Forwarder, universal forwarders all pointing to the Heavy Forwarder, and 1 indexer. I would like the heavy forwarder to only forward certain events on to the indexer. Based upon my research (Route and Filter Data ) I have built the below configurations. outputs.conf [tcpout] indexAndForward = 1 [tcpout:indexerGroup] server = <ip address>:9997 props.conf [default] TRANSFORMS-allNull = setnull [WinEventLog:Security] TRANSFORMS-WinEventLog=setNull,SendToUserAccountIndex,SendToGroupAccountIndex transforms.conf [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [SendToUserAccountIndex] REGEX = ^EventCode=(4720|4722|4725|4738) DEST_KEY = _TCP_ROUTING FORMAT = indexerGroup [SendToGroupAccountIndex] REGEX = ^EventCode=(4727|4730|4728) DEST_KEY = _TCP_ROUTING FORMAT = indexerGroup   Unfortunately, even though the specified events are showing in my Windows Event Logs, and the universal forwarder is forwarding the events properly, the events are not showing in the locally indexed items of forwarded items. It is also not showing on the destination server. If I remove the default stanza from props.conf every event populates, including those events that do not meet the criteria listed above. Based upon this, I believe there is an issue with my source types.  My environment is Splunk Enterprise Version 8.0.3 and and installed on Windows Server 2016.  ... View more