Perform selective indexing and forwarding uberAgent Data

I have the following scenario: An RDS server with uberAgent in a single domain with two users types (managers & common users). I need to forward uberAgent data separated by user type into two different Splunk servers: A Splunk server for managers and other Splunk server for common users.

I have seen that in Splunk has configurations options “Perform selective indexing and forwarding”. How can I configure this scenario to forward uberAgent data to each Splunk server by user type?

1 comment

Please sign in to leave a comment.