topic Re: Send specific Index's from one Indexer to another without Clustering in Splunk Dev

Send specific Index's from one Indexer to another without Clustering

troyfred — Mon, 21 Oct 2019 20:33:19 GMT

We have a few silo'd networks and each has their own Splunk setup. My group is going to ingest specific index's from them but cannot be part of their cluster. How would I send (say for example the Security logs held in the Security_index), from Indexer 1 to indexer 2? So far most of the answers I have come across deal with clustered systems or decommissioning one indexer and search head to bring up another. Any assistance would be greatly appreciated.

Re: Send specific Index's from one Indexer to another without Clustering

sandeepmakkena — Mon, 21 Oct 2019 22:45:46 GMT

I'm sure there will be a better way to achieve this, for now, I can only think of below two options.

Write the event of your Security_index to a file using curl commands like collect and configure other Splunk instant to monitor that file.
The other way is by running the script, here is the link that could help https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptSetup

Thanks, hope this helps!

Re: Send specific Index's from one Indexer to another without Clustering

troyfred — Wed, 23 Oct 2019 16:13:09 GMT

Thanks for the answer, however our client network is super sketchy about pulling from and monitoring that way. We are basically getting a one way from from them to us. So far I have found the following articles related to this setup below. The issue I get now is that if the data is in its own index (lets say security_logs), I get everything EXCEPT those logs but if I use REGEX=(WinEventLog:Security) or REGEX=(WinEventLog | Security), I get all the WinEventLog from things that put their data into the main index.

https://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/Routeandfilterdatad#Replicate_a_subset_of_data_to_a_third-party_system
https://answers.splunk.com/answers/448100/is-it-possible-to-index-and-forward-a-specific-sou.html
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf#IndexAndForward_Processor-----