Splunk duplicate logs isn't working

splunky1 — Tue, 18 May 2021 05:18:47 GMT

I have the following inputs.conf in the UF for Splunk_TA_windows.

My intension is to send a copy of logs into two different indexers, I am aware of license re-use but I am ok with that. With the below config some logs are going to one index and other logs are going to other index.

When I compare the logs in index wineventlog and testsys they are not identical, the logs that I see in wineventlog are different and testsys are different. Looks like some are pushed to one index while other are pushed to

###### Windows OS Logs ##############

[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = testsys
renderXml = false

[WinEventLog://Application]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = wineventlog
renderXml = false

[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)"
index = testsys
renderXml = false

[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = testsys
renderXml = false

[WinEventLog://System]
disabled = 0
start_from = oldest
current_only = 0
checkpointInterval = 5
index = wineventlog
renderXml = false

[WinEventLog://Microsoft-Windows-DriverFrameworks-UserMode/Operational]
disabled = 0

Re: Splunk duplicate logs isn't working

gcusello — Tue, 18 May 2021 06:41:24 GMT

Hi @splunky1,

Splunk doens't index twice the same log so the solution you tried doesn't work.

If you want to send some logs to two indexes (with double license consuption!) you have to follow the steps described at https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data_input

ùIn few words, you have to insert in outputs.conf two destinations

[tcpout:systemGroup] server=server1:9997 [tcpout:applicationGroup] server=server2:9997

and in inputs.conf say which logs must be sent to only one or both the indexes:

[monitor://.../file1.log] _TCP_ROUTING = systemGroup [monitor://.../file2.log] _TCP_ROUTING = applicationGroup

Ciao.

Giuseppe

topic Splunk duplicate logs isn't working in Getting Data In

Splunk duplicate logs isn't working

Re: Splunk duplicate logs isn't working