topic Splunk migration in Getting Data In

Splunk migration

kowsikreddy — Wed, 11 Nov 2020 08:13:52 GMT

Hi We are working on migration to different environments and we are looking to forward same data to different indexers(new indexer) but it is forwarding to only new indexer and it is not forwarding to existing indexer.

We did the below steps to forward data.

Below is the outputs.conf file in Slunk universal forwarder

[tcpout] defaultGroup = existingindexer,newindexer

[tcpout:lb] server = existingindexer:9998

autoLB = true

[tcpout: newindexer] server= server2.com:9998

autoLB = true

And in the inputs.conf we kept both indexers name

[script]

interval = 3600

sourcetype = sqlrun

index = old_index

disabled = 0

[script]

interval = 3600

sourcetype = sqlrun

index = new_index

disabled = 0

Re: Splunk migration

richgalloway — Wed, 11 Nov 2020 16:26:25 GMT

The default group references "existingindexer", but there is no group by that name. That would explain why data is not being sent to the old indexers.

The inputs.conf file has two stanzas by the same name, but with different content. This will NOT create two separate inputs. Instead, the settings in the separate stanzas will be merged into a single stanza. If an attribute is specified more than once in the same stanza then the last value is used.

Re: Splunk migration

kowsikreddy — Thu, 12 Nov 2020 07:46:05 GMT

can you please explain, how we can define 2 indexes in the inputs.conf file to forward same data 2 indexes ?