topic Re: How can I route data to specific indexers using a heavy forwarder? in Getting Data In

How can I route data to specific indexers using a heavy forwarder?

MAShawky — Thu, 29 Sep 2016 09:36:31 GMT

I have a universal forwarder that sends 2 source types to heavy forwarder successfully. i need this heavy forwarder to route the received source types between 2 indexers.

My configurations on heavy forwarder is like below

props.conf

[cron]
 TRANSFORMS-routing=cron-route

[syslog]
 TRANSFORMS-routing=syslog-route

Transforms.conf

[cron-route]
DEST_KEY=_TCP_ROUTING
FORMAT=indexer-1

[syslog-route]
DEST_KEY=_TCP_ROUTING
FORMAT=indexer-2,indexer-1

outputs.conf

[tcpout:indexer-1]
server = 192.168.14.14:9997

[tcpout:indexer-2]
server = 192.168.14.15:9997

Thanks in advance

Re: How can I route data to specific indexers using a heavy forwarder?

jcrabb_splunk — Thu, 29 Sep 2016 16:32:25 GMT

The document that discusses this can be found here:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Forwarding/Routeandfilterdatad#Filter_and_route_event_data_to_target_groups

At first glance, your configuration appears to be mostly right. I think you will also need to include the "REGEX" setting under each transforms.conf stanza.

[cron-route]
REGEX = (.)
DEST_KEY=_TCP_ROUTING
FORMAT=indexer-1

[syslog-route]
REGEX = (.)
DEST_KEY=_TCP_ROUTING
FORMAT=indexer-2,indexer-1

Try and and see if that works.

Re: How can I route data to specific indexers using a heavy forwarder?

MAShawky — Fri, 30 Sep 2016 20:27:25 GMT

solved now,, thanks alot 🙂