Looks plausible. I ll test it, and get feedback to you in a month ! ... View more

"Source A" to Data Collector 01  > IDX Cluster 01 for Data A | (Data Copy from Source A for Cluster 02) | |---> "Source B" to Data Collector 02 > IDX Cluster 02 for Data A and B THX for the link, my config is similar, but... the "Data A" Copy from DC01 direct to IDX Cluster 02 works fine, "Data A" Copy from DC01 to DC02 to IDX Cluster 02 not... Any idea? Is "Data HF hopping" 😉 even possible? Without transforms and props directly via tcp-out over inputs.conf it worked... ... View more

Hi, i have a similar problem... at first my config to forward internal splunk indexes... [tcpout] forwardedindex.0.whitelist = _.* forwardedindex.filter.disable = false defaultGroup = TEST_IDX-CLUSTER [tcpout:TEST_IDX-CLUSTER] forceTimebasedAutoLB = true autoLBFrequency = 30 server = ID01.SPLUNK-TEST.local:9997,ID02.SPLUNK-TEST.local:9997,ID03.SPLUNK-TEST.local:9997 Then i debug with this search... index="_internal" | eval bucket=_bkt | eval indextime=_indextime | table _time, indextime, bucket splunk_server _raw | convert ctime(indextime) | stats count list(*) as * by _raw | where count>1 | fields * _raw | sort - indextime Output: bucket = every bucket is another in one event count = 2 or sometimes 3 indextime = every entry is equal splunk_server = 01,02,03 or 01,01 or 02,03 or 03,03 (many different combinations) Anyone an idea? Regards - Markus ... View more