topic How to forward log files to two different servers? in Getting Data In

How to forward log files to two different servers?

a212830 — Tue, 02 Jun 2015 14:52:01 GMT

Hi,

I need to send some logfiles twice - send one set to my prod system, and another to a dev system. I have two different inputs/outputs in their own apps to handle the processing. Will Splunk do this, or will it determine that the logfiles are already being processed and only read them once?

Re: How to forward log files to two different servers?

rmorlen — Tue, 02 Jun 2015 16:41:06 GMT

You could setup two instances of the splunk forwarder on the same box. One sends to prod, one sends to dev.

If you want all the logs to go to both you could also setup index and forward on the indexers and forward the data.

Re: How to forward log files to two different servers?

yannK — Mon, 28 Sep 2020 20:10:00 GMT

2 forwarders is the easy method. very reliable.

The complex one is :
in outputs.conf : to define 2 tcpout groups,
in inputs.conf : create symlinks to the file, add an extra monitor on the symlink, add crcSALT to avoid conflict.
then and use _TCP_ROUTING rules on inputs.conf
the risk is that if one group is blocked, both will be blocked.