Can you send different logs to different Indexers from the same forwarder?

zbumpers — Wed, 25 Feb 2015 16:01:32 GMT

I would like to be able to send Log A to Indexer A and Log B to Indexer B from one forwarder.

Re: Can you send different logs to different Indexers from the same forwarder?

vincenteous — Wed, 25 Feb 2015 16:32:17 GMT

Hi zbumpers,

From my experience, it is possible to achieve this. You just need to set the proper indexer destination in outputs.conf of the forwarder. Create tcpout groups and then specify the groups to the proper monitoring stanza in inputs.conf. For example, something like this:

Your indexers: 192.168.56.101:8089 and 192.168.56.102:8089

In your forwarder:
outputs.conf:

[tcpout:IndexerA]
server=192.168.56.101:8089
....
....

[tcpout:IndexerB]
server=192.168.56.102:8089
....
....

inputs.conf:

[monitor:///path/to/log/A/logA.log]
# Add attributes to your monitor like sourcetype, index, etc
....
....
# In the end, specify to which indexer this log should be sent using _TCP_ROUTING = <group name>
_TCP_ROUTING = IndexerA

# Do the same for log B
[monitor:///path/to/log/B/logB.log]
....
....
_TCP_ROUTING = IndexerB

Restart the forwarder and see the result. Hope this helps.

References:
http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/inputsconf
http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Outputsconf
http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Configureforwarderswithoutputs.confd

topic Re: Can you send different logs to different Indexers from the same forwarder? in Getting Data In

Can you send different logs to different Indexers from the same forwarder?

Re: Can you send different logs to different Indexers from the same forwarder?