I have one universal forwarder (UF) that is sending production data to the production intermediate Forwarder (IF) and then on to the production indexers.
I would like to start collecting test data from the UF and send it to the LAB indexer.
Is there any way to change the outputs.conf for one app on the UF and leave the outputs.conf that is presently sending live data to the IF?
↧