I have universal forwarder with Splunk_TA_Stream and my app _server_app_audit where in inputs.conf I write `_TCP_Routing = mygroup1` or 2 at each app. After that, I write into outputs.conf `[tcpout:mygroup1 or 2]` ```server = index1:9997 or 2``` at each app but stream sends data to all indexes.
↧