|
hi.. From an indexer, can I transmit one paticular index of all indexes to the other indexer? please answer. |
|
I have a several indexes. index is f5, sos, websphere. only index f5 forwarding another indexer. |
|
Yes, you can do it. You should set the forwarding to happen on the inputs that forward data to the index you're interested in forwarding. Otherwise, you're going to have to do routing based on source/sourcetype/host in props/transforms. http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad Route inputs to specific indexers based on the data's input If you can't use the input method, you can forward a subset of data using the instructions here: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Forwarddatatothird-partysystemsd |
Please state your question a bit more clearly, with examples on what specific task you want to solve.