I need to index data from an appliance we have, however in the appliance you can only specify one syslog server. How can I index the data on our central instance and then forward the data on to a separate heavy forwarder?
We basically have two separate Splunk instances so I need to figure out how to get the data to both of them.
You can route specific events to other Splunk instances, and/or index them locally on the Splunk instances you're routing the events from. See more here: http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Routeandfilterdatad