topic Re: Dual Forwarder Configuration in Getting Data In

Dual Forwarder Configuration

MrWhoztheBoss — Tue, 14 Dec 2021 15:35:19 GMT

Hi Everyone,

I am trying to figure out how can I do dual forwarder configuration for universal forwarders. Can someone please guide me in getting some idea for it or point out to splunk-docs/articles that can be helpful.

Re: Dual Forwarder Configuration

gcusello — Tue, 14 Dec 2021 16:25:49 GMT

Hi @MrWhoztheBoss,

what do you mean with "dual forwarder configuration for universal forwarders"?

You can have many configuration files in the deployed apps but for each parameter you can have only one value.

If instead you want to configure your UF to send logs to two indexers there are many answers to do this.

Ciao.

Giuseppe

Re: Dual Forwarder Configuration

MrWhoztheBoss — Wed, 15 Dec 2021 05:52:35 GMT

Hi @gcusello

I was looking for how I can configure One UF to send data to Two Indexer Groups which are setup in different environment.

Re: Dual Forwarder Configuration

gcusello — Wed, 15 Dec 2021 08:01:09 GMT

Hi @MrWhoztheBoss,

if you want to send the all the logs to two groups of indexers, you have to configure this situation in outputs.conf, something like this:

[tcpout:Group1] server=server11:9997,server12:9997 disabled=false [tcpout:Group2] server=server21:9997,server22:9997 disabled=false

If instead you want to send only a part of logs to each group of indexers, you have to follow the instructions at https://docs.splunk.com/Documentation/Splunk/8.2.3/Forwarding/Routeandfilterdatad#Filter_and_route_event_data_to_target_groups

Ciao.

Giuseppe