topic Re: Can UF send data to multiple indexes in Getting Data In

Can UF send data to multiple indexes

rashi83 — Mon, 02 Dec 2019 22:38:38 GMT

I am using Splunk forwarder (not HEC) and want to know if I can send data to multiple indexes.
If yes, how?

Re: Can UF send data to multiple indexes

ivanreis — Tue, 03 Dec 2019 01:33:29 GMT

you can send data to multiple indexers.
In order to do it, you have setup the outputs.conf like the sample below and deploy this file to your UF clients using the deployment server.

[tcpout]
defaultGroup = indexers

[tcpout:indexers]
server = 10.1.1.197:9997, 10.1.1.200:9997, 10.1.1.201:9997

For further information, please check this document -> https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Outputsconf#outputs.conf.example

Re: Can UF send data to multiple indexes

manjunathmeti — Tue, 03 Dec 2019 04:22:42 GMT

Are you trying to index same data in multiple indexes?

Re: Can UF send data to multiple indexes

woodcock — Tue, 03 Dec 2019 04:24:31 GMT

Using HEC, it is really easy (because you do not need to fight the fishbucket), just do multiple post calls. Is this not working for you?