Split forwarding - locally indexing Splunk internal audits; forwarding system operating logs

I should probably know the answer to this, but it eludes me.

The search head of my deployment also acts as the enterprise licence server. I want to forward all the operating system logs to be indexed on one of the main indexers along with all our other management host system logs, but I want the internal audit files to remain indexed locally. If I simply enable forwarding of all logs to the indexer the internal audit detail (used for Splunk licence usage/performance reports) disappears, even if the appropriate index is created and enabled on the indexer, and besides I prefer to have the audit detail exactly where it always has been. Aggregate outputs.conf is below:

splunk@searchhead[pts/0 2013-08-07 12:31:54]:~$ splunk cmd btool outputs list --debug
system     [tcpout]
system     autoLB = true
system     defaultGroup =
system     disabled = false
system     forwardedindex.0.whitelist = .*
system     forwardedindex.1.blacklist = _.*
system     forwardedindex.2.whitelist = _audit
system     forwardedindex.3.blacklist = summary_.*
system     forwardedindex.4.blacklist = linux_.*
system     forwardedindex.filter.disable = false
system     indexAndForward = 0
system     maxQueueSize = 500KB
system     [tcpout:indexer.domain_9997]
system     disabled = false
system     forwardedindex.0.blacklist = .*
system     forwardedindex.0.whitelist =
system     forwardedindex.1.blacklist =
system     forwardedindex.1.whitelist = linux_.*
system     forwardedindex.2.whitelist =
system     forwardedindex.3.blacklist =
system     forwardedindex.4.blacklist =
system     server = indexer.domain:9997

This has now been changed to

splunk@searchhead[pts/0 2013-08-07 16:49:02]:~$ /opt/splunk/bin/splunk btool outputs list --debug
system     [tcpout]
system     autoLB = true
system     defaultGroup =
system     disabled = true
system     forwardedindex.0.whitelist = .*
system     forwardedindex.1.blacklist = _.*
system     forwardedindex.2.whitelist = _audit
system     forwardedindex.3.blacklist = summary_.*
system     forwardedindex.4.blacklist = linux_.*
system     forwardedindex.filter.disable = false
system     indexAndForward = 0
system     maxQueueSize = 500KB
system     [tcpout:indexer.domain_9997]
system     disabled = false
system     forwardedindex.0.whitelist = linux_.*
system     forwardedindex.1.blacklist = .*
system     server = indexer.domain:9997