Configure an app to target a specific splunk server

tmontney — Mon, 12 Oct 2020 19:08:36 GMT

I have two servers (all-in-one), one's production the other development. Sometimes, I'd like to have a forwarder send data to both. The app from production sends the usual data to just the production server. Is there a way to limit the app's scope when an app is deployed from development? Right now, it's sending data from the development app to the production server.

Re: Configure an app to target a specific splunk server

gcusello — Tue, 13 Oct 2020 06:43:47 GMT

Hi @tmontney,

I'm not sure to have understood your need.

Anyway, if you have the DS you can have on the Forwarders only the apps from the DS, this means that there isn't any difference in scope related to the DS, it depends only on the deployed Apps (or better TAs if you're speaking of Forwarders).

So If you want to limit the scope of a data flow , you have two ways:

if the scope limitation is the number of inputs, in the TA you can configure your inputs to send data to both the servers or only to the production one;
if instead you want to send to development server only a part of logs, you can do this only on the production server, but it isn't easy, e.g. you could schedule an alert with a search that sends the results to the development server e.g. by syslog.

Anyway dubbing logs you have a double license consuption!

Ciao.

Giuseppe

topic Configure an app to target a specific splunk server in Getting Data In

Configure an app to target a specific splunk server

Re: Configure an app to target a specific splunk server