topic Re: a single forwarder to two different indexer in Getting Data In

a single forwarder to two different indexer

SplunkCSIT — Fri, 28 Mar 2014 02:01:03 GMT

Can we forward logs to two different indexer, if it a manual task such that to change at the inputs.conf and outputs.conf or auto at the Splunk Web itself? thks
e.g
Logs1 to indexer1
logs2 to indexer2

Re: a single forwarder to two different indexer

melonman — Mon, 28 Sep 2020 16:15:35 GMT

I hope this helps:

http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Routeandfilterdatad

you have to configure props.conf, transforms.conf, outputs.conf. The step is shown in the doc above.
In your canse, you probably need to create multiple stanza with source in props.conf:
[source::YOUR_LOG1_PATH] to set specific log1 files to be sent to Indexer1
[source::YOUR_LOG2_PATH] to set specific log2 files to be sent to Indexer2
and so on.

Re: a single forwarder to two different indexer

linu1988 — Fri, 28 Mar 2014 05:21:37 GMT

Hello,
It's very easy.

in outputs.conf

[tcpout:indexer1] server=Y.Y.Y.Y:9997 [tcpout:indexer2] server=X.X.X.X:6666

for more info you can refer outputs.conf.spec file in your splunk instance.

Thanks

Re: a single forwarder to two different indexer

SplunkCSIT — Sun, 30 Mar 2014 06:24:46 GMT

thks, if it true that it is not able to configure the multiple stanza from the GUI and need to do it manually thru the inputs.conf, right? Because the moment i configured my data inputs at the GUI, it will start to send over to indexer1 by default. If i done it manually at inputs.conf, do i need to restart the Splunk forwarder to take effect or i will take effect immediately upon changes at inputs.conf?

Re: a single forwarder to two different indexer

linu1988 — Sun, 30 Mar 2014 08:46:33 GMT

any change forwarders need to restart