https://community.splunk.com/t5/Getting-Data-In/Splunk-Fowarder-2-distincts-inputs-outputs/m-p/64329#M12946 <P>You sure can! You will need to use TCP_ROUTING in your inputs.</P> <P>So it might go something like this:</P> <P><CODE>[outputs.conf]<BR /> [tcpout:UDP10001]<BR /> server=server1:9997<BR /> [tcpout:UDP10002]<BR /> server=server2:9997</CODE></P> <P><CODE>[inputs.conf]<BR /> [udp://10001]<BR /> _TCP_ROUTING = UDP10001<BR /> [udp://10002]<BR /> _TCP_ROUTING = UDP10002</CODE></P> <P><CODE><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data.27s_input" target="test_blank">http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data.27s_input</A></CODE></P> Fri, 14 Dec 2012 15:34:13 GMT alacercogitatus 2012-12-14T15:34:13Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Fowarder-2-distincts-inputs-outputs/m-p/64328#M12945 <P>Hello,</P> <P>I would like to know if that possible to configure on a single splunk fowarder, 2 distincts inputs and outputs.</P> <P>In a concrete way, i would to receive the inputs logs coming from :</P> <UL> <LI>UDP:10001 and send them to TCP:10001 in output</LI> <LI>UDP:10002 and send them to TCP:10002 in output</LI> </UL> <P>The only configuration i see, is centralizing the logs in a single point from the inputs, and send them to the outputs.<BR /> I want 2 distincts flow is it possible ?</P> <P>It should look like this</P> <P><IMG src="http://hfr-rehost.net/self/79a64d91e869aeb977fe274fcbb540a0c8cbde71.jpg" alt="alt text" /></P> <P>Thanks !</P> Fri, 14 Dec 2012 15:05:27 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Fowarder-2-distincts-inputs-outputs/m-p/64328#M12945 rbw78 2012-12-14T15:05:27Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Fowarder-2-distincts-inputs-outputs/m-p/64329#M12946 <P>You sure can! You will need to use TCP_ROUTING in your inputs.</P> <P>So it might go something like this:</P> <P><CODE>[outputs.conf]<BR /> [tcpout:UDP10001]<BR /> server=server1:9997<BR /> [tcpout:UDP10002]<BR /> server=server2:9997</CODE></P> <P><CODE>[inputs.conf]<BR /> [udp://10001]<BR /> _TCP_ROUTING = UDP10001<BR /> [udp://10002]<BR /> _TCP_ROUTING = UDP10002</CODE></P> <P><CODE><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data.27s_input" target="test_blank">http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data.27s_input</A></CODE></P> Fri, 14 Dec 2012 15:34:13 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Fowarder-2-distincts-inputs-outputs/m-p/64329#M12946 alacercogitatus 2012-12-14T15:34:13Z