topic Re: Splitting indexes between multiple output groups in Getting Data In

Splitting indexes between multiple output groups

shadysplunker — Thu, 30 May 2024 15:11:31 GMT

Hi,

We are collecting the logs directly though UF and HEC in the indexer cluster. All inputs are defined in Cluster Manager and then bundle is applied to indexers.

Currently we are sending the data to Splunk indexers as well as to other output group. Following is the config of outputs.conf under peer-apps:

[tcpout]

indexandForward=true

[tcpout:send2othergroup]

server=.....

sslPassword=.....

sendCookedData=true

This config is currently sending the same data to both the outputs. Indexing locally and then forwarding to another group.

Is there a way to keep some indexes to be indexed locally and some to be sent only to another group? I tried using props and transforms by including _TCP_ROUTING but it is not working at all.

Thanks in advance!

Re: Splitting indexes between multiple output groups

gcusello — Thu, 30 May 2024 15:16:42 GMT

Hi @shadysplunker,

did you followed the instructions at https://docs.splunk.com/Documentation/Splunk/9.2.1/Forwarding/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data_input ?

see "Perform selective indexing and forwarding".

Ciao.

Giuseppe

Re: Splitting indexes between multiple output groups

shadysplunker — Thu, 30 May 2024 17:05:10 GMT

Hi @gcusello,

I went through the documentation but could not find any example to route HTTP inputs. Will this still work if I plan to use "outputgroup=<string>" in inputs.conf of HEC?

//Yash

Re: Splitting indexes between multiple output groups

gcusello — Fri, 31 May 2024 06:10:40 GMT

Hi @shadysplunker,

sorry, maybe I misunderstood.

please, describe better your requirements because tcpout is only for sending logs from a UF to an Indexer, why are you speaking of http?

in the above link there's a description of performing a selective addressing of logs from an UF to IDXs.

Ciao.

Giuseppe