https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435728#M76028 <P>Sure just have a look at the docs about cloning.</P> Tue, 29 Jan 2019 13:41:39 GMT dkeck 2019-01-29T13:41:39Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435722#M76022 <P>I have one heavy forwarder and two different cloud indexers.</P> <OL> <LI>heavy forwarder (HF)</LI> <LI>indx1(placed in cloud 1)</LI> <LI>indx2(placed in cloud 2)</LI> </OL> <P>Both are the part for different cluster. Is it possible to send the data from the HF to both the cloud indexers at the same time.</P> <P>What will be the steps?</P> Tue, 29 Jan 2019 07:14:49 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435722#M76022 vin02ptl 2019-01-29T07:14:49Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435723#M76023 <P>HI,</P> <P>sure you can send data to both indexer.</P> <P>Splunk automatically load balance incoming data to indexer you specify in outputs.conf</P> <P>Like this </P> <PRE><CODE>[tcpout: my_LB_indexers] server=10.10.10.1:9997,10.10.10.2:9997 </CODE></PRE> <P>OR</P> <P>if you want to clone the data like this:</P> <PRE><CODE>[tcpout] defaultGroup=indexer1,indexer2 [tcpout:indexer1] server=10.1.1.197:9997 [tcpout:indexer2] server=10.1.1.200:9997 </CODE></PRE> <P>docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Configureforwardingwithoutputs.conf#Configure_data_cloning_on_a_universal_forwarder_with_outputs.conf</P> Tue, 29 Sep 2020 23:00:03 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435723#M76023 dkeck 2020-09-29T23:00:03Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435724#M76024 <P>both the indexers are in different cloud and they are part of totally different cluster and environment. </P> Tue, 29 Jan 2019 12:30:10 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435724#M76024 vin02ptl 2019-01-29T12:30:10Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435725#M76025 <P>If you HF can send to both indexer via recieving port 9997 I don´t see why this should not work.</P> <P>You can also set up your HF to be a gateway forwarder for other UF´s</P> <P><A href="https://docs.splunk.com/Documentation/SplunkCloud/7.2.3/Data/Forwarddata">https://docs.splunk.com/Documentation/SplunkCloud/7.2.3/Data/Forwarddata</A></P> Tue, 29 Jan 2019 12:33:17 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435725#M76025 dkeck 2019-01-29T12:33:17Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435726#M76026 <P>It should be work as per the above steps as posted by <STRONG>dKeck</STRONG>. If still not working then please share the output.conf settings.</P> Tue, 29 Jan 2019 13:32:32 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435726#M76026 ashishebansal 2019-01-29T13:32:32Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435727#M76027 <P>@vin02ptl - Do you want same data to go to both indexers? <BR /> If that's the case I don't think this approach would work. </P> Tue, 29 Jan 2019 13:39:47 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435727#M76027 sarif_splunk 2019-01-29T13:39:47Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435728#M76028 <P>Sure just have a look at the docs about cloning.</P> Tue, 29 Jan 2019 13:41:39 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435728#M76028 dkeck 2019-01-29T13:41:39Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435729#M76029 <P>Thanks for your reply.......yes I want same data to go to both the indexers.</P> Tue, 29 Jan 2019 16:29:04 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435729#M76029 vin02ptl 2019-01-29T16:29:04Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435730#M76030 <P>Just test the config for cloning I posted. Its working</P> Tue, 29 Jan 2019 16:33:12 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435730#M76030 dkeck 2019-01-29T16:33:12Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435731#M76031 <P>You can create 2 different output groups in <CODE>outputs.conf</CODE> but there are some important considerations/downsides, including:</P> <P>1: You will take a license hit twice on this data.<BR /> 2: Test the configurations for back-pressure problems. Depending on the version of Splunk and the settings that are in place, a blockage of one indexer tier can effect transmission of data to the unblocked indexer tier.</P> Tue, 29 Jan 2019 16:36:39 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-transfer-data-from-a-heavy-forwarder-to-two/m-p/435731#M76031 woodcock 2019-01-29T16:36:39Z