topic How to send the same data to multiple Splunk Enterprise platforms? in Getting Data In

How to send the same data to multiple Splunk Enterprise platforms?

yu94 — Mon, 28 Mar 2022 21:22:38 GMT

Hello,

I have a requirement of sending the same data from the SplunkForwarder agents to 2 different Splunk enterprise platforms to 2 different index.
Example -
Platform 1-- index1
Platform 2 -- index2
I need 2 different solutions

how can we achieve this by changing the configs at SplunkForwarder agents only
how can we achieve this by changing the configs at intermediate forwarders only

Thanks in advance.

Regards,
Thippesh

Re: How to send the same data to multiple Splunk Enterprise platforms

gcusello — Wed, 30 Aug 2017 10:58:41 GMT

Hi yu94,
If all Your Forwarders pass through Heavy Forwarders it's the same thing, otherwise you have to change configuration in HFs and in each Forwarder that don't pass through HFs.
You have to modify outputs.conf that I suggest to deploy using a Deployment Server (if you have many Forwarders).
Anyway you have to insert in your outputs.conf both the target Indexers, something like this

[tcpout:Indexer1]
server = xxx.xxx.xxx.xxx:9997
disabled = false
[tcpout-server://xxx.xxx.xxx.xxx:9997]

[tcpout:Indexer2]
server=yyy.yyy.yyy.yyy:9997
disabled = false
[tcpout-server://yyy.yyy.yyy.yyy:9997]

If you want to forward logs to both the Indexers it's sufficient to use this outputs.conf, if you want selectively send some logs to one Indexer and other to the second, you have to insert in each stanza of your inputs.conf _TCP_ROUTING = <tcpout_group_name>,<tcpout_group_name>,<tcpout_group_name>, ...

See http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

Bye.
Giuseppe

Re: How to send the same data to multiple Splunk Enterprise platforms

gcusello — Sat, 26 Mar 2022 07:07:46 GMT

Hi @yu94,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉