data routing

data routing

noun

A method of data distribution where one Splunk Enterprise instance routes and forwards data to one or more receiving Splunk Enterprise instances based on the data content. For example, in a situation where one forwarder routes data to two indexers, the forwarder matches conditions based on patterns in the data to selectively send some data to one of the receivers and the rest of the data to the other receiver.

You can use data routing to send event data to specific queues, indexes, or third-party systems.

You can also use data routing in conjunction with cloning and load balancing.

For more information

In Forwarding Data:

• About forwarding and receiving
• Route and filter data
• Forward data to third-party systems