We have data being forwarded (heavy forwarder) to a spunk server 1 , and we also forward (heavy forwarder) from that splunk server 1 to an other splunk server 2.
Is there a way to filter out forwarded messages so messages forwarded to server 1 are not sent to server 2 ?
Thanks for any hints !
Do you mean to say splunk server1 is an indexer too?
Anyway try this link to filter or route your data
http://docs.splunk.com/Documentation/Splunk/6.3.1511/Forwarding/Routeandfilterdatad
Let me know if it helped!