topic Configure forwarding data to two tcpout groups without blocking on group failure. in Getting Data In

Configure forwarding data to two tcpout groups without blocking on group failure.

jg91 — Fri, 16 Dec 2022 23:04:06 GMT

Is it possible to configure heavy forwarders to send data to two tcpout groups (A,B) (outputs.conf) and don't block on group B failure?

We want to send all data to group A, and a subset of data (specific sourcetypes) to group B, but group B is in a remote location and our link to that location is not fully stable and we don't want to event loss in group A on link failures or group B failures.

[tcpout] [tcpout:groupA] server=indexerA1_ip:9997,indexerA2_ip:9997 [tcpout:groupB] server=indexerB_ip:9997

Re: Configure forwarding data to two tcpout groups without blocking on group failure.

gcusello — Sat, 17 Dec 2022 06:24:53 GMT

@jg91,

yes it should be possible: you have to configure a fork to send data to two groups of indexers following the instructons at https://docs.splunk.com/Documentation/Splunk/9.0.2/Forwarding/Routeandfilterdatad#Filter_and_route_event_data_to_target_groups

Sincerely I never tested this situation but If one group isn't available HF should cache those data and send them to the second group when available.

Ciao.

Giuseppe