Hi splunkers,
Good day! I just want to ask some opinion what is the best way I can do or is it possible to achieve this:
I have 1 forwarder, forwarding the data to my indexer cluster rf=3 and sf=3. I'm planning to add two new indexers peering together to index different stuff. I want this forwarder to forward the data to this new group of indexers for this different purpose.
apachelogs ---> Forwarder ----> indexer cluster1
systemlogs ---> Forwarder -----> indexer cluster2
Thanks
Hi sympatiko!
Probably tcp_routing can establish this. There are some good answers on this site on how to establish this