Hello,
I have a Splunk instance that is a search head and an indexer.
I would like this Splunk instance to index everything exception data of sourcetype=otherDepartmentData.
For sourcetype of otherDepartmentData, it will not be indexed locally but will forwarded to another indexer. No other data will be forwarded out.
It is not clear to me in the Splunk documentation how this can be configured.
Thanks.
Cheers,
Jack
↧