topic Re: How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers? in Getting Data In

How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers?

sameera123 — Wed, 13 Jul 2016 06:42:37 GMT

I have a small scale Splunk Enterprise instance installed on one server which does not index the data locally. Data is pointed to a central server to index it. Outputs on that server are configured/polled through deployment server. However, I now want to configure inputs which need to be indexed locally without disturbing the existing outputs.conf. If someone helps me with ideas, it would be a great help.

Re: How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers?

gcusello — Wed, 13 Jul 2016 07:27:41 GMT

See this
http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Routeandfilterdatad#Configure_selective_indexing
there are many examples:
- Index one input locally and then forward the remaining inputs
- Index one input locally and then forward all inputs
I used it.

Bye.
Giuseppe

Re: How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers?

sameera123 — Wed, 13 Jul 2016 08:24:02 GMT

Thanks Giuseppe!! I too got this option. but the thing is inorder to implement this option i should edit my outputs.conf which i dont like to since after a deploy poll push it may get change ..

Can we restrict to an app to send the data to dedicated indexer or local?

I mean to ask can we create outputs.conf where we can specify the data should index data locally in app?

Re: How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers?

gcusello — Tue, 29 Sep 2020 10:13:36 GMT

To implement a selective indexing, you have to configure the outputs.conf file and then ALL the inputs.conf stanzas (each one)!
When you insert the command
_TCP_ROUTING = my_new_route
in one stanza of inputs.conf file, the input is locally indexed or sent to the remote indexers.
otherwise if you don't insert the above command in a stanza, the inputs of the stanza are both locally indexed and sent to the remote indexers (and there is a doble license consumption!).

In outputs.conf you configure only the servers to send logs, the destination (local or remote) must be specified in each inputs.conf stanzas.

Bye.
Giuseppe
P.S.: please accept the answer if you like 😉

Re: How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers?

sameera123 — Tue, 29 Sep 2020 10:12:13 GMT

I dont think we need to change all other inputs stanza's with the _TCP_Routing if you have already specified defaultGroup as reomote server(indexer).

Can we create dedicated outputs.conf under the app where we need the inputs which needs the data index locally?if we do so the precedence goes to system/local or app/local since we have the inputs localy in the app?

General precedence s system /local but not sure about in case of above condition occurs...

Please clarify

Re: How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers?

gcusello — Tue, 29 Sep 2020 10:12:35 GMT

I don't like to have more outputs.conf!
Everyway try with the dafault group, I found that when I don't insert _TCP_ROUTING ... logs are sent to alla the indexers (local and remote).
Bye.
Giuseppe

Re: How to restrict specific data to be indexed locally, not interrupting data being forwarded and indexed on remote servers?

gcusello — Fri, 09 Sep 2016 11:09:15 GMT

if you're satisfied of the answer, please, accept the answer.
Bye.
Giuseppe