Getting Data In

splunk to forward 1 index only

Federica_92
Communicator

Hello everyone : )

I have a splunk instance with an alert manager app that is producing logs that are being indexed on the same machine as index=alerts.
I would like to forward this data to another splunk instance, without use an universal forwarder, but only changing the outputs.conf file in splunk.

Using this system, I m forwarding ALL the logs are contains in my splunk istance to the other one, but I would like to send only index=alerts.

How can I change the inputs/outputs.conf to allow this?

Thanks,
Federica

0 Karma

dcharboneau_spl
Splunk Employee
Splunk Employee

Look at this link:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Forwarding/Routeandfilterdatad#Forward_data_for_a_...

Outputs.conf: in “$splunkhome$/etc/system/local/outputs.conf
Something like what is below:
[tcpout]
defaultGroup = local
indexAndForward=true
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = alerts

[tcpout:whatever] -- Whatever it is set to now should work if it is already forwarding everything.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...