We have a few silo'd networks and each has their own Splunk setup. My group is going to ingest specific index's from them but cannot be part of their cluster. How would I send (say for example the Security logs held in the Security_index), from Indexer 1 to indexer 2? So far most of the answers I have come across deal with clustered systems or decommissioning one indexer and search head to bring up another. Any assistance would be greatly appreciated.
I'm sure there will be a better way to achieve this, for now, I can only think of below two options.
collect
and configure other Splunk instant to monitor that file.Thanks, hope this helps!
Thanks for the answer, however our client network is super sketchy about pulling from and monitoring that way. We are basically getting a one way from from them to us. So far I have found the following articles related to this setup below. The issue I get now is that if the data is in its own index (lets say security_logs), I get everything EXCEPT those logs but if I use REGEX=(WinEventLog:Security) or REGEX=(WinEventLog | Security), I get all the WinEventLog from things that put their data into the main index.
https://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/Routeandfilterdatad#Replicate_a_subset...
https://answers.splunk.com/answers/448100/is-it-possible-to-index-and-forward-a-specific-sou.html
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf#IndexAndForward_Processor-----