topic Re: Can a single universal forwarder forward data to two different indexers? in Getting Data In

Can a single universal forwarder forward data to two different indexers?

pavanae — Mon, 27 Jul 2015 15:22:36 GMT

I am using a Universal Forwarder, say in Machine A. It has logs at one path, say Log Path1. Now I want this Forwarder to forward LogPath1 data to one indexer say "B" and to other indexer say "C".

Is this scenario possible? pls help.

Re: Can a single universal forwarder forward data to two different indexers?

martin_mueller — Mon, 27 Jul 2015 16:50:56 GMT

You can choose between load balancing and data cloning: http://docs.splunk.com/Documentation/Splunk/6.2.4/Forwarding/Configureforwarderswithoutputs.confd#Define_typical_deployment_topologies

Re: Can a single universal forwarder forward data to two different indexers?

bmacias84 — Mon, 27 Jul 2015 16:57:47 GMT

This is only available in with the heavy forwarders.

Re: Can a single universal forwarder forward data to two different indexers?

martin_mueller — Mon, 27 Jul 2015 17:56:18 GMT

I'm pretty sure a universal forwarder can do load balancing and data cloning.

Re: Can a single universal forwarder forward data to two different indexers?

acharlieh — Mon, 27 Jul 2015 17:58:40 GMT

@bmacias84 While per event routing will only work in heavy forwarders / indexers, generic cloning using only inputs.conf and outputs.conf which deal with data sources as wholes will work in Universal forwarders as well. (you might even be able to do per-event routing if you have a data source using INDEXED_EXTRACTIONS on the UF as well :), but that's a big exceptional flow)