How can I send the same data to multiple indexers?

daniel333 — Mon, 15 Jun 2020 20:48:37 GMT

All,

I am in a transition state moving from one instance of Splunk to another. The old instance needs to stay up for a while, but I'd like to start shipping a certain subset of data (one sourcetype) to the new stack as well.

Is there a way to get a universal forwarder to send all data to two separate indexers?

Re: How can I send the same data to multiple indexers?

burwell — Tue, 16 Jun 2020 04:53:53 GMT

Hi Daniel!

Splunk calls this data cloning

https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Configureforwardingwithoutputs.conf#Configure_data_cloning_on_a_universal_forwarder_with_outputs.conf

Use outputs.conf like this:

[tcpout]
defaultGroup=cloned_group1,cloned_group2

[tcpout:cloned_group1]
server=10.10.10.1:9997, 10.10.10.2:9997, 10.10.10.3:9997

[tcpout:cloned_group2]
server=10.1.1.197:9997, 10.1.1.198:9997, 10.1.1.199:9997, 10.1.1.200:9997

topic Re: How can I send the same data to multiple indexers? in Getting Data In

How can I send the same data to multiple indexers?

Re: How can I send the same data to multiple indexers?