https://community.splunk.com/t5/Getting-Data-In/How-to-move-internal-logs-from-Deployment-Server-internal-db-to/m-p/115608#M24174 <P>Hello,</P> <P>I'm having a hard time finding a way forwarding all the internal logs from my Deployment server to the Index server.<BR /> My idea is to actually move from _internal &gt; _internal instead of _internal &gt; main index. This is basically to consolidate the license usage logs in just one server, since my deployment server is my license master.</P> <P><STRONG>This is how my inputs.conf file looks like:</STRONG></P> <P><EM>[monitor://$SPLUNK_HOME/var/log/splunk]<BR /> _TCP_ROUTING=indexserver<BR /> [monitor://$SPLUNK_HOME/etc/splunk.version]<BR /> _TCP_ROUTING=indexserver</EM></P> <P><STRONG>This is how my outputs.conf file looks like:</STRONG></P> <P><EM>[tcpout]<BR /> forwardedindex.0.whitelist = _internal<BR /> forwardedindex.1.whitelist = _audit<BR /> forwardedindex.filter.disable = false<BR /> indexAndForward = false<BR /> defaultGroup = indexserver<BR /> [tcpout:indexserver]<BR /> server = 10.10.10.10:9997<BR /> compressed = true<BR /> autoLB = true<BR /> [tcpout-server://10.10.10.10:9997]<BR /> sslCertPath = $SPLUNK_HOME/etc/auth/server.pem<BR /> sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem<BR /> sslVerifyServerCert = false<BR /> sslPassword = password</EM></P> <P>Thanks for the help,</P> <P>//Santiago Aloi Deheza</P> Mon, 28 Sep 2020 18:09:04 GMT santiagoaloi 2020-09-28T18:09:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-move-internal-logs-from-Deployment-Server-internal-db-to/m-p/115608#M24174 <P>Hello,</P> <P>I'm having a hard time finding a way forwarding all the internal logs from my Deployment server to the Index server.<BR /> My idea is to actually move from _internal &gt; _internal instead of _internal &gt; main index. This is basically to consolidate the license usage logs in just one server, since my deployment server is my license master.</P> <P><STRONG>This is how my inputs.conf file looks like:</STRONG></P> <P><EM>[monitor://$SPLUNK_HOME/var/log/splunk]<BR /> _TCP_ROUTING=indexserver<BR /> [monitor://$SPLUNK_HOME/etc/splunk.version]<BR /> _TCP_ROUTING=indexserver</EM></P> <P><STRONG>This is how my outputs.conf file looks like:</STRONG></P> <P><EM>[tcpout]<BR /> forwardedindex.0.whitelist = _internal<BR /> forwardedindex.1.whitelist = _audit<BR /> forwardedindex.filter.disable = false<BR /> indexAndForward = false<BR /> defaultGroup = indexserver<BR /> [tcpout:indexserver]<BR /> server = 10.10.10.10:9997<BR /> compressed = true<BR /> autoLB = true<BR /> [tcpout-server://10.10.10.10:9997]<BR /> sslCertPath = $SPLUNK_HOME/etc/auth/server.pem<BR /> sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem<BR /> sslVerifyServerCert = false<BR /> sslPassword = password</EM></P> <P>Thanks for the help,</P> <P>//Santiago Aloi Deheza</P> Mon, 28 Sep 2020 18:09:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-move-internal-logs-from-Deployment-Server-internal-db-to/m-p/115608#M24174 santiagoaloi 2020-09-28T18:09:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-move-internal-logs-from-Deployment-Server-internal-db-to/m-p/115609#M24175 <P>Just wanted to clarify that the inputs and outputs above are correct and that it works.</P> <P>It takes one day till you can actually see the rollover summary.</P> <P>index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d<BR /><BR /> | eval _time=_time - 43200 <BR /> | bin _time span=1d<BR /> | stats latest(b) AS b by slave, pool, _time <BR /> | timechart span=1d sum(b) AS volume fixedrange=false <BR /> | foreach * [eval =round(''/1024/1024/1024, 3)]</P> Mon, 28 Sep 2020 18:07:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-move-internal-logs-from-Deployment-Server-internal-db-to/m-p/115609#M24175 santiagoaloi 2020-09-28T18:07:46Z