topic Re: How can I clone data from a HF to two different splunk instances? in Getting Data In

How can I clone data from a HF to two different splunk instances?

lucacaldiero — Tue, 16 Sep 2025 13:55:29 GMT

How can I clone data from a HF to two different splunk instances? Doubling defaultgroup in outputs.conf does not work.

#splunk #clone #heavyforwarder

Re: How can I clone data from a HF to two different splunk instances?

lucacaldiero — Tue, 16 Sep 2025 14:09:09 GMT

is something like this correct?

props.conf
[default]
TRANSFORMS-routing=alldata

transforms.conf
[alldata]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=newgroup

outputs.conf
[tcpout]
defaultGroup=oldgroup

[tcpout:newgroup]
server=server = xxxx.xxxx.xxxx.:9997

[tcpout:oldgroup]
server=xx.xx.xx.xx:9997

Re: How can I clone data from a HF to two different splunk instances?

gcusello — Tue, 16 Sep 2025 16:54:42 GMT

Hi @lucacaldiero ,

a people from Splunk Support said to me that this solution shouldn't run, but I used it with success:

outputs.conf [tcpout:newgroup] server=server = xxxx.xxxx.xxxx.:9997 [tcpout:oldgroup] server=xx.xx.xx.xx:9997

Don't use defaultGroup.

In this way, you send all logs to both the destinations.

Ciao.

Giuseppe

Re: How can I clone data from a HF to two different splunk instances?

livehybrid — Tue, 16 Sep 2025 22:14:03 GMT

Hi @lucacaldiero

In your transforms.conf you would need to have both groups in the _TCP_ROUTING:

[alldata] REGEX=. DEST_KEY=_TCP_ROUTING FORMAT=newgroup,oldgroup

This will also only work for data ingested directly on the UF, or sent to it from a UF as otherwise it would arrive already parsed, however setting both groups in outputs.conf should work I think - how come this didnt work for you?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: How can I clone data from a HF to two different splunk instances?

PrewinThomas — Wed, 17 Sep 2025 04:17:53 GMT

@lucacaldiero

If you want to clone all data from the Heavy Forwarder to both destinations, this should be sufficient.

[tcpout] defaultGroup = newgroup,oldgroup [tcpout:newgroup] server = xxxx.xxxx.xxxx:9997 [tcpout:oldgroup] server = xx.xx.xx.xx:9997

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!