Thanks again! The btool command is new to me. The results are much bigger in Forwarder 2, so there might be something in there. ... View more

By the way, the forwarder is a Universal one. I created the config using the splunk commands on the command line, which I created based on Forwarder1. I did verify it by comparing the inputs.conf and outputs.conf files. They are exactly the same. I just changed the host name. The data from Forwarder 2 does get sent to the Indexers correctly, but it just goes into the wrong index. That's the only problem I have.  Both indexers have a props.conf with a stanza named with the source_type and a TRANSFORMS-routetoindex which points to a stanza in a transfroms.conf. The source_type is exactly the same in both Forwarders. Not sure if this will give you a clue to the cause of the problem. Thanks ... View more

Hi PicleRick Thanks for your answer. 1. Is there such a thing as support service? I just posted this hoping to get some kind of help, wherever it comes from. 🤞If there is online support, I'd appreciate if someone could tell me how to contact them. 2. Yes, the environment is old. Strangely enough the only problem I'm having is with the 9.2.1 forwarder. The old 6.x is OK. And the indexers (7.3.3) are a bit old, but they do work. Yes, I have also verified the configs are exactly the same. For that reason, I was wondering whether 9.2.1 required something new or different in the config. Thanks   ... View more