topic Forwarding between multiple forwarders then to indexer in Getting Data In

Forwarding between multiple forwarders then to indexer

ramsanga — Thu, 19 Jun 2014 13:17:33 GMT

My Splunk architecture is like this

I have three data centers (DC) and one each heavy forwarder in them .In each DC all the servers are forwarding the logs to heavy forwarder of the same DC via universal forwarders

I also have existing spunk set up in distributed architecture with two heavy forwarders two indexer and two search head.
Only heavy forwarders are routable in our environment and receives logs from infrastructure devices and then sending further to indexers in LB mode.

So, i would like to know if we can forward logs from heavy forwarder in each DC to this existing routable heavy forwarder then further to indexer I have read few answers regarding UF sending logs to intermediate forrwarder and then further to indexers. but could not find any specific answers on documentation on forwarding log between two or multiple heavy forwarders.

Many thanks in advance...

Re: Forwarding between multiple forwarders then to indexer

yannK — Thu, 19 Jun 2014 14:15:14 GMT

Yes you can.

Re: Forwarding between multiple forwarders then to indexer

ramsanga — Fri, 20 Jun 2014 09:14:31 GMT

Thanks .

Can we send unparsed logs from each DC to routable heavy forwarders. I wanted to route logs from each DC to specific indexes dedicated for these DC. Which is the best place to configure logs routing DC indexes or routable indexes. At the moment all infrastructure logs routing is done in routable forwarder. I will appreciate if you can help with sample configuration.