topic Re: Universal forwarder: how to forward different logs to different indexers? in Getting Data In

Universal forwarder: how to forward different logs to different indexers?

arkadyz1 — Mon, 28 Sep 2020 20:00:52 GMT

I have two different Splunk applications on two different search heads. Right now those search heads are also indexers, but this might change in the future.

Anyway: I defined two groups in etc/system/local/outputs.conf, and referred to one or another using _TCP_ROUTING in each monitor stanza in etc/system/local/inputs.conf. I also removed default stanza from outputs.conf, so that there are no default groups. Is this setup good enough for the purpose?

Re: Universal forwarder: how to forward different logs to different indexers?

acharlieh — Fri, 22 May 2015 16:22:39 GMT

Offhand (quickly not looking at the docs) that sounds right. Are you seeing problems with it?

Edit: wait actually you may want to set the default routing to a dummy group if you don't want events to go anywhere by default.

Re: Universal forwarder: how to forward different logs to different indexers?

arkadyz1 — Fri, 22 May 2015 16:36:57 GMT

I haven't seen any problems yet, but wanted to double check if I'm not missing something. Thanks for this 'dummy group' remark - I'll take a look into it.

Re: Universal forwarder: how to forward different logs to different indexers?

woodcock — Sun, 24 May 2015 03:59:31 GMT

Another way you could do it is to stand up 2 different instances of Splunk, but I would only use this approach if at least one of your input types is compressed (e.g. *.gz, *zip, etc.) because the AQ is single-threaded and could use the help anyway.