topic Universal Forwarder to report 2 Indexer in Getting Data In

Universal Forwarder to report 2 Indexer

ansif — Wed, 11 Sep 2019 12:13:13 GMT

What is the best way to route security events to Security Indexers and rest of the sourcetypes to operational indexers?

And Can we manage universal forwarder with 2 deployment servers?

Re: Universal Forwarder to report 2 Indexer

gcusello — Wed, 30 Sep 2020 02:06:50 GMT

hI ansif,
I answer first at the second question: you must set only one Deployment Server for a Universal Forwarder, you can have more Deployment Servers but each one manage its UFs.
about the way to send some events to an Indexer and some events to another one, you should see https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data_input .
In few words, you have to configure a fork in outputs.cof of your Universal Forwarders that defines the destination Indexers.
Then in inputs.conf you can define which logs must be sent to Security indexers and which ones to other Indexers calling the stanzas in outputs.conf.
Example
In outputs.conf, create stanzas for each receiving indexer:

[tcpout:systemGroup]
server=server1:9997
[tcpout:secutityGroup]
server=server2:9997

In inputs.conf, specify _TCP_ROUTING to set the stanza in outputs.conf that each input should use for routing:

[monitor://.../file1.log]
_TCP_ROUTING = systemGroup
[monitor://.../file2.log]
_TCP_ROUTING = securityGroup

Bye.
Giuseppe

Re: Universal Forwarder to report 2 Indexer

ansif — Thu, 12 Sep 2019 07:50:04 GMT

Hi @gcusello :

Can we use Indexer discovery ? Like 2 master node details in the tcpout?

Re: Universal Forwarder to report 2 Indexer

gcusello — Thu, 12 Sep 2019 08:01:49 GMT

Yes, insted to address Indexers in outputs.conf, you can address Master Nodes' addresses and enable indexer discovery
Bye.
Giuseppe

Re: Universal Forwarder to report 2 Indexer

ansif — Thu, 12 Sep 2019 08:10:46 GMT

Thanks @gcusello

Re: Universal Forwarder to report 2 Indexer

ansif — Fri, 17 Jan 2020 16:06:30 GMT

@gcusello : Just adding to it:

Can we forward all default indexes like internal audit etc to both Indexers?

Re: Universal Forwarder to report 2 Indexer

gcusello — Wed, 30 Sep 2020 03:45:15 GMT

Yes, if you don't configure a default tcpout in outputs.conf and you don't insert _TCP_ROUTING in inputs.conf.
This doesn't consume license but consumes storage, so you have to understand if you really need or not duplicating internal logs (I don't think!).

Ciao.
Giuseppe

Re: Universal Forwarder to report 2 Indexer

ansif — Thu, 20 Feb 2020 11:24:36 GMT

The 2 instances are managed by 2 separate teams and both teams requires internal logs to troubleshoot.

Thanks for the answer. I will goahead and test this.