topic Can single forwarder forward data to two different indexer's ?? in Getting Data In

Can single forwarder forward data to two different indexer's ??

rakesh_498115 — Fri, 21 Jun 2013 14:47:56 GMT

I am using a UF say in Machine A , its has logs at two different paths say Log Path1 and Log Path2 . Now i want this Forwarder to forward LogPath1 data to one indexer say "C" and LogPath2 data to other indexer say "D" and i dont want LogPath1 data to be present in "D" Machine and viceversa.

Is this scenario possible ?? pls help.

Re: Can single forwarder forward data to two different indexer's ??

chris — Fri, 21 Jun 2013 15:08:08 GMT

Hi yes this is possible, you have to define 2 groups in outputs.conf and specify which input (log path) you want to send to which group Link to routing documentation

outputs.conf

[tcpout:c]
server=server1:9997

[tcpout:d]
server=server2:9997

inputs.conf

[monitor://path/file1.log]
_TCP_ROUTING = c

[monitor://path/file2.log]
_TCP_ROUTING = d

Re: Can single forwarder forward data to two different indexer's ??

MartinMcNutt — Sun, 23 Jun 2013 02:41:05 GMT

Watch out...This would be a double hit against your license.

Splunk needs to improve their DR/clustering to give better control over sending data to Hot spares or DR boxes without a double his on license.

Re: Can single forwarder forward data to two different indexer's ??

Ayn — Sun, 23 Jun 2013 07:35:12 GMT

iirc there at least used to be HA licenses that you could use for indexing on multiple indexers without having to pay double the license costs.

Re: Can single forwarder forward data to two different indexer's ??

chris — Mon, 28 Sep 2020 14:09:20 GMT

If you specify the _TCP_ROUTING for every input, this setup will not index your data twice and will therefore not count twice towards your license.

Re: Can single forwarder forward data to two different indexer's ??

rakesh_498115 — Mon, 24 Jun 2013 07:49:13 GMT

Thanks Chris 🙂

Re: Can single forwarder forward data to two different indexer's ??

rakesh_498115 — Wed, 03 Jun 2015 10:53:11 GMT

Can i forward data from single UF to 2 different indexers. same data in 2 different index groups. ?? is this possible.?

Re: Can single forwarder forward data to two different indexer's ??

acharlieh — Wed, 03 Jun 2015 11:58:47 GMT

yes, you configure outputs.conf as described in the docs

Re: Can single forwarder forward data to two different indexer's ??

jmeyers_splunk — Tue, 24 May 2016 18:46:37 GMT

I realize this comment is pretty old, but I wanted to supply an update to anybody who ends up here...

Indexer Clustering (http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Aboutclusters) seems to take care of your needs around license consumption. It will replicate data in the background without incurring any additional splunk ingest.

Re: Can single forwarder forward data to two different indexer's ??

agup006 — Sun, 02 Jul 2017 21:19:25 GMT

You can also use Fluentd Enterprise to bifurcate data to separate indexers. You can use message content, message type, hostname, etc. to route the messages between the indexers. https://fluentd.treasuredata.com/splunk-optimize