Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Indexing some and forwarding some on a full Splunk instance

$
0
0
Hello, I have a Splunk instance that is a search head and an indexer. I would like this Splunk instance to index everything exception data of sourcetype=otherDepartmentData. For sourcetype of otherDepartmentData, it will not be indexed locally but will forwarded to another indexer. No other data will be forwarded out. It is not clear to me in the Splunk documentation how this can be configured. Thanks. Cheers, Jack

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>