topic Re: Forward an index to another Splunk instance (n00b) in Getting Data In

How to forward an index to another Splunk instance (n00b)?

gsfc_linux_dan — Mon, 13 Feb 2023 17:15:54 GMT

I found this Index and Forward data into another splunk instance and then found the current version of the referenced documentation: Documentation - Splunk® Enterprise - Forwarding Data - Route and filter data , but I am still confused.

We have a requirement to push data to another Splunk instance, outside out immediate network. On which node of the Splunk cluster can I do this from ?

Re: Forward an index to another Splunk instance (n00b)

gcusello — Mon, 13 Feb 2023 15:21:53 GMT

Hi @gsfc_linux_dan,

the configurations described in the referred pages are usually applied on Forwarders (Heavy and/or Universal) not on Indexers.

Ciao.

Giuseppe

Re: Forward an index to another Splunk instance (n00b)

gsfc_linux_dan — Mon, 13 Feb 2023 15:31:57 GMT

Thanks for pointing that out. Please bear with this n00b 😎

The forwarder in the cluster is, of course, a heavy forwarder. If we set it up to create the index in question, we should then be able to push it to our own indexers AND to the other folks that need the data.

Does that sound like "The Right Way" to do it ?

Re: Forward an index to another Splunk instance (n00b)

gcusello — Mon, 13 Feb 2023 16:15:42 GMT

Hi @gsfc_linux_dan,

there's something not completely exact:

Forwarders aren't clustered, only Indexers or Search Heads, you could have more Heavy Forwarders to avoid Single Points of Failure but it isn't a cluster.

You don't need to creat an index on Forwarders, they only forward logs to Indexers.

Anyway, yes: following the instructions in the documentation (Filter and Route Data) you can create a fork to send data from your Heavy Forwarders both to your Indexers and the other Indexers.

I used this approach in many projects: it isn't a so rare configuration!

Ciao.

Giuseppe

Re: Forward an index to another Splunk instance (n00b)

gsfc_linux_dan — Mon, 13 Feb 2023 16:17:55 GMT

Many thanks for providing a few clues to this clueless n00b.

Re: Forward an index to another Splunk instance (n00b)

gcusello — Mon, 13 Feb 2023 16:24:04 GMT

Hi @gsfc_linux_dan,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Forward an index to another Splunk instance (n00b)

gsfc_linux_dan — Mon, 13 Feb 2023 16:53:14 GMT

A few straggling details:

The single Forwarder is not clustered, just part of the group of nodes making up the whole Splunk instance. My apologies for confusion.

I expect if we add a second Forwarder, we will have to duplicate the push configuration so that data going thru either Forwarder gets where it needs to go.

Thanks again.