topic Splunk forwarder - local logs to one Splunk server, sourcetype cisco_esa to another in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-local-logs-to-one-Splunk-server-sourcetype/m-p/54837#M10645 <P>I need to set up a Splunk forwarder to send /var/log/messages and /var/log/secure (with add monitor <DIRECTORY>)from a machine to our main Splunk server but also send monitored files from another directory on this same server to a separete, specific Splunk server with sourcetype cisco_esa.</DIRECTORY></P> <P>Can this be done by configuring inputs.conf and outputs.conf on a single Universal forwarder?</P> <P>I've been able to get the individual tasks accomplished. And I'm considering running 2 instances of Universal forwarder. Just wondering if this can be done with one.</P> Thu, 17 May 2012 19:27:24 GMT rutlandn 2012-05-17T19:27:24Z Splunk forwarder - local logs to one Splunk server, sourcetype cisco_esa to another https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-local-logs-to-one-Splunk-server-sourcetype/m-p/54837#M10645 <P>I need to set up a Splunk forwarder to send /var/log/messages and /var/log/secure (with add monitor <DIRECTORY>)from a machine to our main Splunk server but also send monitored files from another directory on this same server to a separete, specific Splunk server with sourcetype cisco_esa.</DIRECTORY></P> <P>Can this be done by configuring inputs.conf and outputs.conf on a single Universal forwarder?</P> <P>I've been able to get the individual tasks accomplished. And I'm considering running 2 instances of Universal forwarder. Just wondering if this can be done with one.</P> Thu, 17 May 2012 19:27:24 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-local-logs-to-one-Splunk-server-sourcetype/m-p/54837#M10645 rutlandn 2012-05-17T19:27:24Z Re: Splunk forwarder - local logs to one Splunk server, sourcetype cisco_esa to another https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-local-logs-to-one-Splunk-server-sourcetype/m-p/54838#M10646 <P>In inputs.conf you can use the _TCP_ROUTING property to target different forwarding groups in outputs.conf for the different sourcetypes being monitored.</P> Mon, 28 Sep 2020 11:50:19 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-local-logs-to-one-Splunk-server-sourcetype/m-p/54838#M10646 Damien_Dallimor 2020-09-28T11:50:19Z