topic Re: Does Splunk Universal Forwarder support multiple Destinations or is the paid version required? in Getting Data In

Does Splunk Universal Forwarder support multiple Destinations or is the paid version required?

FGo — Mon, 24 Apr 2023 14:56:31 GMT

Dear Splunk team,

regarding the mentioned blog entry -- does the UF support sending to multiple destinations ("Data Cloning") or is the paid version -- HF -- required?

Thanks in advance for your effort,

Frank

Re: Splunk Universal Forwarder and Two Destinations

richgalloway — Mon, 24 Apr 2023 14:00:40 GMT

What is the blog entry of which you speak?

One does not have to pay for an HF. The software is free to use. You pay only for the data you store in Splunk (ingestion model) or the resources you use to process stored data (workload model).

To answer the question, yes, a UF can clone data to multiple destinations - provided all of the destinations are Splunk instances. Sending data to a syslog destination requires an HF.

Re: Does Splunk Universal Forwarder support multiple Destinations or is the paid version required?

gcusello — Tue, 25 Apr 2023 09:20:57 GMT

Hi @FGo,

at first HF isn't a paid version: in Splunk you pay only for indexed logs, if you don't index, but you only forward logs, you don't pay anythig!

Then, in the outputs.conf of your Universal Forwarder, you can configure two or more destinations:

if you want to duplicate all logs, try in outputs.conf:

[tcpout:Group1] server=x.x.x.x:9997 [tcpout:Group2] server=y.y.y.y:9997

If instead you want to send only a part of logs, follow the instructions at https://docs.splunk.com/Documentation/Splunk/9.0.4/Forwarding/Routeandfilterdatad#Filter_and_route_event_data_to_target_groups,.

Ciao.

Giuseppe