topic Re: Will configuring a Universal forwarder to send the same logs to two different Splunk instances cause performance issues? in Getting Data In

Will configuring a Universal forwarder to send the same logs to two different Splunk instances cause performance issues?

nabhosal — Tue, 29 Sep 2020 16:07:14 GMT

Hi All,

We are planning to configure a universal forwarder to send logs to two different Splunk instances i.e.to clone data.

Configuration we are going to use is,

In outputs.conf

[tcpout]
defaultGroup = default-autolb-group

[tcpout:indexer1]
server=A.A.A.A:9997, B.B.B.B:9997

[tcpout:indexer2]
server=C.C.C.C:9997 D.D.D.D:9997

In inputs.conf

[default]
_TCP_ROUTING = *

I just need to confirm, but will this cause performance issues on the server where the UF is installed?

Re: Will configuring a Universal forwarder to send the same logs to two different Splunk instances cause performance issues?

yannK — Fri, 06 Oct 2017 19:23:00 GMT

No particular performance issues, just double network traffic.
But remember that with cloning if one destination is not available, it will pause all forwarding.

Re: Will configuring a Universal forwarder to send the same logs to two different Splunk instances cause performance issues?

nabhosal — Mon, 09 Oct 2017 08:02:49 GMT

Hi,

Thanks for your help.
As per your comment with cloning if one destination is not available, it will pause all forwarding, does it mean if one group is not reachable UF will stop forwarding to other also?