How to effectively route non-internal logs to external Indexers ?

dm1 — Mon, 26 Jul 2021 07:08:59 GMT

In my current setup, I want to forward only internal logs to Indexers in myOrg, whereas, some non-internal logs to Indexers of an external Org.

Below is my current outputs.conf, however, its not working as intended. I am seeing forwarder attempting to forward non-internal logs to myOrg's indexers as well.

[tcpout] defaultGroup = Internal_indexers #disable default filters forwardedindex.0.whitelist = forwardedindex.1.blacklist = forwardedindex.2.whitelist = forwardedindex.3.whitelist = #Enable these forwardedindex.4.whitelist = (_audit|_introspection|_internal|_telemetry) [tcpout:Internal_indexers] server = index01:9997 [tcpout:OrgA_indexer] server = y.y.y.y:9997

Update:

Below is inputs.conf for non-internal log

[monitor://some_source.log] index = abc sourcetype = syslog _TCP_ROUTING = OrgA_indexer

Re: How to effectively route non-internal logs to external Indexers ?

venkatasri — Mon, 26 Jul 2021 10:56:42 GMT

Hi @dm1

Can you try this out as you are setting at defaultGroup level you might need to block other non-internals.

[tcpout] defaultGroup = Internal_indexers #disable default filters forwardedindex.0.whitelist = (_audit|_introspection|_internal|_telemetry) forwardedindex.1.blacklist = .*

_TCP_ROUTING to other indexer should work fine without any issues , hope you have done a restart of UF post this change and are you sure this OrgA indexer is in active forwarder list? Try ./splunk list forward-server

topic Re: How to effectively route non-internal logs to external Indexers ? in Getting Data In

How to effectively route non-internal logs to external Indexers ?

Re: How to effectively route non-internal logs to external Indexers ?