topic Re: Heavy Forwader data route between multiple indexer in Getting Data In

Heavy Forwader data route between multiple indexer

ikulcsar — Sat, 18 Feb 2017 13:56:19 GMT

Hi!

I know there are several questions in this topic, but I didn't find a solution for me.
I try to create a simple lab splunk system with 1 HF and 2 indexers (ix1, ix2). HF has 2 input udp://1514 and udp://1515.

I tried to forward udp://1514 to ix1 and udp://1515 to ix2 with no luck. Somehow both indexers receives both logs:(

inputs.conf

[udp://1514]
connection_host = ip
sourcetype = syslog

[udp://1515]
connection_host = ip
sourcetype = syslog

props.conf

[source::udp://1514]
TRANSFORMS-ix1 = send_to_ix1

[source::udp://1515]
TRANSFORMS-ix2 = send_to_ix2

transform.conf

[send_to_ix1]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = indexer_1

[send_to_ix2]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = indexer_2

output.conf

[tcpout:indexer_1]
server = 192.168.10.220:9997

[tcpout:indexer_2]
server = 192.168.10.221:9997

What am I doing wrong, please help me.
The final goal is to filter the logs received by indexers and send everything to a 3rd party log collector.

Thank your for your time,
Steven

Re: Heavy Forwader data route between multiple indexer

pradeepkumarg — Tue, 29 Sep 2020 12:55:41 GMT

You don't need transforms to route data to specific indexer group. All you need to do is specify _TCP_ROUTING in your inputs like below

[udp://1514]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_1

[udp://1515]
connection_host = ip
sourcetype = syslog
_TCP_ROUTING = indexer_2

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Inputsconf

Re: Heavy Forwader data route between multiple indexer

ikulcsar — Mon, 20 Feb 2017 10:08:20 GMT

Thank you, it looks good.

But in the near future, I'll have to use REGEX for log filtering. Maybe can you explain why my solution isn't working?
Here is two page, I tried to solve the porblem based on these links?
https://wiki.splunk.com/Community:Test:How_Splunk_behaves_when_receiving_or_forwarding_udp_data
http://docs.splunk.com/Documentation/Splunk/6.5.2/Forwarding/Forwarddatatothird-partysystemsd

Regards,
Steven

Re: Heavy Forwader data route between multiple indexer

ikulcsar — Mon, 20 Feb 2017 15:06:41 GMT

Finally, I found the problem. I made a typo in the transforms.conf file name. btool helps me to find the error.