How to index summary indexes on a Search Head locally, and forward all other data to the indexer?

Question

Does anyone have any config pointers for the following scenario:

We have a Search Head, and it runs apps that generate summary index data. We would like it to store its summary indexes locally. But, it is also collecting other data (say, scripted inputs from the UNIX app), and we want to send this other (non-summary, license-using) data to the indexer. How to do this?

Accepted Answer

Evidently in 4.2 the index forwarding is much more granular.

Per the docs, you can specify exactly which indexes get forwarded in outputs.conf.

Defaults:

[tcpout]
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = _audit

Forward all but indexes starting with Summary:

[tcpout]
forwardedindex.0.blacklist = summary.*
forwardedindex.1.whitelist = .*
forwardedindex.2.blacklist = _.*
forwardedindex.3.whitelist = _audit

How to index summary indexes on a Search Head locally, and forward all other data to the indexer?

Follow this question

Splunk Resources

Related questions