Forwarders & Deployment • Room 3

Data Routing & Filtering

Architects design data routing strategies to send different data to different indexes, or to the nullQueue to drop unwanted events entirely.

Routing is configured via `props.conf` (matching sourcetype) and `transforms.conf` (defining the routing rule with `DEST_KEY=_MetaData:Index` or `DEST_KEY=queue` for nullQueue).

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Check which forwarders are connected to this indexer: `index=_internal source=*metrics.log group=tcpin_connections`.

Splunk Search Bar