Guys, I wish to collect all events from my windows server security log and send to my main Splunk enterprise instance but also send a subset of events to my test instance. At the forwarder, how could I achieve this?
↧