We are forwarding data from an indexer in a remote data center to our primary indexer with no issues. What I would like to do next is forward that data to a specific index in the primary indexer. Is this possible? Thanks!
Hi,
You could add the below route settings in the inputs.conf of the Primary Index and then use props and transforms to override and set the index for all incoming events.
[splunktcp://1111]
route=has_key:_utf8:parsingQueue;has_key:_linebreaker:parsingQueue;absent_key:_utf8:parsingQueue;absent_key:_linebreaker:parsingQueue