topic Unique universal forwarder to multiple destinations in Getting Data In

Unique universal forwarder to multiple destinations

Flobzh — Tue, 20 May 2025 19:26:35 GMT

Hello,

Is it possible to have only 1 Universal Forwarder installed on a Windows server and this UF sends data to 2 different Splunk instances

Ex:

1- Source: IIS logs -> Dest = SplunkCloud

2- Source: event viewer data -> Dest = On Premise Splunk Enterprise

If yes can you point to an article that help setup this?

Other possible constraint: we have a deployment server that should allow to setup both flow.

Thanks for your help

Re: Unique universal forwarder to multiple destinations

livehybrid — Tue, 20 May 2025 19:31:21 GMT

Hi @Flobzh

Yes you can achieve this with multiple output groups in your outputs.conf and then props/transforms.conf to filter as required.

For more details documentation and examples check out https://docs.splunk.com/Documentation/SplunkCloud/latest/Forwarding/Routeandfilterdatad

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Unique universal forwarder to multiple destinations

livehybrid — Tue, 20 May 2025 19:36:54 GMT

In fact, if its specific data sources which you want to send to different places then you wont need to touch props/transforms - instead you can set _TCP_ROUTING in your inputs.conf stanzas, setting the value to be the output group that you want to use, for example:

== inputs.conf == [monitor:///some/path/someFile.log] index=someIndex sourcetype=myAppLogs _TCP_ROUTING=myOnPremOutputGroup [monitor:///some/path/IIS/logs] index=iis_logs sourcetype=iis:logs _TCP_ROUTING=mySplunkCloudOutputGroup

Also worth reading https://community.splunk.com/t5/Getting-Data-In/Issue-with-default-outputs-when-TCP-ROUTING/m-p/509716

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Unique universal forwarder to multiple destinations

Flobzh — Tue, 20 May 2025 19:40:03 GMT

Thanks, I'll look into this and confirm the behavior.

Re: Unique universal forwarder to multiple destinations

isoutamo — Tue, 20 May 2025 20:47:03 GMT

In UF you should define those two different outputs groups. Then you just add into your inputs.conf in every inputs, which doesn’t use default output group

_TCP_ROUTING = <your additional output group>

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

If you need some routing based on content of events then you must add HF (heavy forwarder) after UF and then you can route it as @livehybrid shows.