Heavy forwarder logs - Splunk Cloud & Test Indexers

[umesh]

Hi Team,

I wanted to forward my logs from heavy forwarder to Splunk Cloud and the same logs should forward to my test indexers as well.

Now the configurations exists to forward the logs to Splunk cloud indexers and how to configure the same logs to forward to test indexers.

Where do we configure the outputs.conf and how do we  configure.

Is there a possibility  for this type of requirement. 

Please do let us know.

Thanks & Regards,

Umesh

[gcusello]

Hi @umesh,

here you can find the configuration to send your logs to two different indexers groups: https://docs.splunk.com/Documentation/Splunk/9.0.5/Forwarding/Routeandfilterdatad#Filter_and_route_e...

in addition, in this url I answered to the same question of another people and you can take the needed information: https://community.splunk.com/t5/Deployment-Architecture/Is-there-a-way-for-HF-double-forward-to-Splu...

Ciao.

Giuseppe