https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-one-Deployment-Server-against-two-separate/m-p/446647#M77680 <P>Hello all,</P> <P>Is it possible to use one deployment Server against two separate indexers or would I need to use two Deployment servers to achieve this?</P> <P>I need to pull various logs from 100 Servers.o Could the deployment server send out the apps in a way where the logs would go to two separate indexers? I know when we initially install the forwarders on the nodes we want to receive data from, we have to specify a Deployment server + Indexer. </P> <P>This is how we would like to break it up</P> <P>Indexer 1) Perfmon, SQL, Event Logs<BR /> indexer 2) IIS</P> <P>Please let me know if this is possible, if so how? I'd imagine it's syntax added to a .conf file somewhere. Thank you!</P> Thu, 13 Dec 2018 21:05:26 GMT Jarohnimo 2018-12-13T21:05:26Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-one-Deployment-Server-against-two-separate/m-p/446647#M77680 <P>Hello all,</P> <P>Is it possible to use one deployment Server against two separate indexers or would I need to use two Deployment servers to achieve this?</P> <P>I need to pull various logs from 100 Servers.o Could the deployment server send out the apps in a way where the logs would go to two separate indexers? I know when we initially install the forwarders on the nodes we want to receive data from, we have to specify a Deployment server + Indexer. </P> <P>This is how we would like to break it up</P> <P>Indexer 1) Perfmon, SQL, Event Logs<BR /> indexer 2) IIS</P> <P>Please let me know if this is possible, if so how? I'd imagine it's syntax added to a .conf file somewhere. Thank you!</P> Thu, 13 Dec 2018 21:05:26 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-one-Deployment-Server-against-two-separate/m-p/446647#M77680 Jarohnimo 2018-12-13T21:05:26Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-one-Deployment-Server-against-two-separate/m-p/446648#M77681 <P>You can use single deployment server against two separate indexers and universal forwarders.<BR /> You need to point your apps/add-on to indexers and universal forwarders under serverclass.conf($SPLUNK_HOME/etc/system/local/serverclass.conf). </P> <P>Try something like this:</P> <PRE><CODE>#---------------Indexer 1------------------ [serverClass:indexer1] filterType = whitelist restartSplunkd = 1 repositoryLocation = /opt/splunk/etc/deployment-apps whitelist.0 = splunk-idx1* [serverClass:indexer1:app:perfmon] [serverClass:indexer1:app:SQL] [serverClass:indexer1:app:event_logs] #---------------Indexer 2-------------------- [serverClass:indexer2] filterType = whitelist restartSplunkd = 1 repositoryLocation = /opt/splunk/etc/deployment-apps whitelist.0 = splunk-idx2* [serverClass:indexer2:app:IIS] </CODE></PRE> Thu, 13 Dec 2018 21:18:23 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-use-one-Deployment-Server-against-two-separate/m-p/446648#M77681 muralikoppula 2018-12-13T21:18:23Z