Back to Floor
Forwarders & Deployment • Room 3
Data Routing & Filtering
Architects design data routing strategies to send different data to different indexes, or to the nullQueue to drop unwanted events entirely.
Routing is configured via `props.conf` (matching sourcetype) and `transforms.conf` (defining the routing rule with `DEST_KEY=_MetaData:Index` or `DEST_KEY=queue` for nullQueue).
Knowledge Check
Prove your understanding to clear the room (Rewards XP)
Check which forwarders are connected to this indexer: `index=_internal source=*metrics.log group=tcpin_connections`.
Splunk Search Bar
>