topic Re: Clone all data received from one indexer to another indexer in Getting Data In

How do I clone all data received from one indexer to another indexer?

andrew207 — Wed, 14 Sep 2022 16:34:02 GMT

Hello,

I have one indexer cluster that receives data over inputs.conf [splunktcp://9997].

I want to clone all data received by this indexer cluster on this port to another Splunk instance, which also listens on 9997. I understand this will double my license consumption.

Current: UF --> Indexer (stores all data)

Desire: UF --> Indexer (stores all data) --> Other Indexer (also stores all data)

How can I clone all data received on 9997 from one indexer to another?

Thanks

Re: Clone all data received from one indexer to another indexer

gcusello — Wed, 14 Sep 2022 06:26:11 GMT

Hi @andrew207,

you can create a fork on your UF to send data to both Cluster and additional Indexes.

You have to add a group to outputs.conf, something like this:

[tcpout] defaultGroup=indexer_cluster,Other_indexer [tcpout:indexer_cluster] server=xxx.xxx.xxx.xxx:9997 [tcpout:other_indexer] server=yyy.yyy.yyy.yyy:9997

In other words, add both the addressing of the Cluster and the other Indexers.

Ciao.

Giuseppe

Re: Clone all data received from one indexer to another indexer

andrew207 — Wed, 14 Sep 2022 06:29:25 GMT

Hello @gcusello

I am performing the cloning from a source indexer, not from a uf. This means there is currently no outputs.conf configured, and your answer does not work.

Thanks

Re: Clone all data received from one indexer to another indexer

gcusello — Wed, 14 Sep 2022 06:40:09 GMT

Hi @andrew207,

if you want to clone all the data of an Indexers sending them to another, you have only to configure your indexers to Forward data to another Indexes and locally store a copy of the files.

You can do this by GUI [Settings -- Forwarding and Receiving -- Forwarding]

It surely runs on a single Indexer, I never tried with a Cluster, but it should run.

Check if configuring for Forwarding only one peer of the Cluster you forward all the data or (as I suppose) you need to configure all the peers.

Ciao.

Giuseppe