These indexes are in the blacklist: [tcpout] indexAndForward = true [tcpout:indexerB_9997] disabled = false server = indexerB:9997 forwardedindex.filter.disable = false forwardedindex.0.blacklist = index_1 forwardedindex.1.blacklist = index_3 forwardedindex.2.whitelist = index_2 Probably something missing or misconfigured? Thanks. ... View more

We still receiving wrong events on destination indexer when the indexer/fwd start like the following: received event for unconfigured/disabled index='index_1' with source='source::/logs/aaa_.log' host='host::aaa0000' sourcetype='sourcetype::aaa_sourcetype' (2 missing total) received event for unconfigured/disabled index='index_3' with source='source::/logs/bbb.log' host='host::bbb0000' sourcetype='sourcetype::bbb_sourcetype' (4 missing total) ... View more

Configuration with forwardedindex seems working, the only issue is that at indexer startup some events from blacklisted index still remain forwarded, probably because the filters configuration are not fully loaded ? Is there a way to prevent this? I need also to override (at indexer level) index declared by the Univ. forwarder. I have tried to put index=xxxx in the inputs.conf stanza but without results. Or at least reconfigure the index tag in the re-forwarded events. Any suggestion is appeciated. thanks. ... View more

Hi R. Turk, thanks for response. Our scenario (we are an IT Outsourcer) is to collect data (and store/retain on our indexer for IT/Security Analisys/Compliance) for our customers and than send the same "raw" copy to their indexer (with independent License) managed by them. Our indexer should act as data collector and aggregator (we can't send directly to them with forwarders) and for some customers (not all..) forward/route also the data. We can summarize in this way: FWD(1,2,..n) -> IndexerA (Our indexer) (Index1) Local (Index2) Local + Forward -> IndexerB (Customer1 Indexer) (IndexN) Local I have tried indexAndForward=true but this forward all indexes data. I have tried (as explained in the Manuals) selectiveIndexing=true and _INDEX_AND_FORWARD_ROUTING=local _TCP_ROUTING=indexerB on the dedicated tcp port on our indexer but we got config error on indexer startup. We don't need to filter or make selective routing at this stage, we "simply" need to forward any indexed data to the destination indexer. Looking around I have not found some sample configuration, so the question here is to understand if the indexer is able to store data in a local index and then forward (or routing) the same data to another indexer. Thanks for help and suggestion. ... View more