topic How do I configure the outputs.conf file to forward data into two separate instances of Splunk? in Getting Data In

How do I configure the outputs.conf file to forward data into two separate instances of Splunk?

dchima — Tue, 23 Oct 2018 21:11:03 GMT

Hello Splunk user community,

i have Linux VMS that are already reporting into a Splunk enterprise instance using a universal forwarder (UF). I recently set up a Splunk POC instance and would like to leverage the existing UFs to fork that data into my Splunk POC simultaneously.

To be specific, i'm implementing the collectd daemon for the 1st time to support a Splunk application. It attempts to deploy the UF and if one is already present, it ignores the UF but does install the collectd.

i know of the outputs.conf and using stanzas, but I just need the syntax to make this happen. This is what i currently have and i need to add to it...

[t-splunk@lgtisplunk1 ~]$ cat /apps/splunk/etc/system/local/outputs.conf
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = lgtisplunk1.calpers.ca.gov:9997

[tcpout-server://lgtisplunk1.calpers.ca.gov:9997]

thank you,
david

Re: How do I configure the outputs.conf file to forward data into two separate instances of Splunk?

gjanders — Tue, 23 Oct 2018 21:34:11 GMT

Refer to Configure data cloning on a universal forwarder with outputs.conf if you want to clone the data or if you want to selectively forward data you can refer to Route and filter data

Re: How do I configure the outputs.conf file to forward data into two separate instances of Splunk?

Rob2520 — Tue, 29 Sep 2020 21:44:11 GMT

Looking for something like this to happen?

Route inputs to specific indexers based on the data input
In this scenario, you use inputs.conf and outputs.conf to route data to specific indexers, based on the data's input. Universal and light forwarders can perform this kind of routing.

Here's an example that shows how this works.

In outputs.conf, create stanzas for each receiving indexer:
[tcpout:systemGroup]
server=server1:9997

[tcpout:applicationGroup]
server=server2:9997

In inputs.conf, specify _TCP_ROUTING to set the stanza in outputs.conf that each input should use for routing:
[monitor://.../file1.log]
index=
sourcetype=
_TCP_ROUTING = systemGroup

[monitor://.../file2.log]
index=
sourcetype=
_TCP_ROUTING = applicationGroup

The forwarder routes data from file1.log to server1 and data from file2.log to server2.

For more information https://docs.splunk.com/Documentation/Splunk/7.1.3/Forwarding/Routeandfilterdatad

Re: How do I configure the outputs.conf file to forward data into two separate instances of Splunk?

dchima — Tue, 23 Oct 2018 21:39:40 GMT

thank you all

Re: How do I configure the outputs.conf file to forward data into two separate instances of Splunk?

gjanders — Tue, 23 Oct 2018 21:40:44 GMT

Just note that props/transforms will need to be in the heavy forwarder or indexer in most cases, so that second link relates to a Splunk enterprise instance for routing data (in the majority of cases)