topic How can I forward data from UniversalForwarder for 2 instances? in Getting Data In

How can I forward data from UniversalForwarder for 2 instances?

Klimdy — Tue, 29 Sep 2020 18:45:43 GMT

I have universal forwarder with Splunk_TA_Stream and my app _server_app_audit where in inputs.conf I write _TCP_Routing = mygroup1 or 2 at each app. After that, I write into outputs.conf [tcpout:mygroup1 or 2] server = index1:9997 or 2 at each app but stream sends data to all indexes.

Re: How can I forward data from UniversalForwarder for 2 instances?

p_gurav — Mon, 02 Apr 2018 10:42:33 GMT

Can you please give sample configuration files to understand requirement more?

Re: How can I forward data from UniversalForwarder for 2 instances?

Klimdy — Tue, 29 Sep 2020 18:45:45 GMT

inputs.conf in Splunk_TA_Stream on forwarder:

[streamfwd://streamfwd]
_TCP_ROUTING = testGroup
splunk_stream_app_location = https://my_indexer2:8000/en-us/custom/splunk_app_stream/
stream_forwarder_id =
disabled = 0

outputs.conf in Splunk_TA_Stream on forwarder:

[tcpout:testgroup]
server = my_indexer2:9997

and i have a second app on forwarder:

inputs.conf in _server_app_my_app on forwarder:

[monitor:///var/log/audit/audit.log]
_TCP_ROUTING = prodgroup
disabled = false
index = auditd
sourcetype = linux:audit

ouputs.conf in _server_app_my_app on forwarder:

[tcpout:prodgroup]
server = my_indexer1:9997

Before, I had outputs.conf in /local but i deleted it and after that restart splunkforwarder. Deployment server is my_indexer1, i need stream data routing to my_indexer2 and linux:audit to my_indexer1, but stream data is routing on 2 indexer.