topic Re: Splunk Default group in Installation

Splunk Default group

pankajupadhyay — Wed, 14 Oct 2020 13:11:22 GMT

On forwarder, We have placed in the outputs.conf as default group of indexer so in this case all the logs by default forward to Indexer.

But if i do not want to send specific logs to indexer which is in default group then what need to be done?

Please help

Re: Splunk Default group

gcusello — Wed, 14 Oct 2020 13:18:11 GMT

Hi @pankajupadhyay,

yopu can find all the infos at https://docs.splunk.com/Documentation/Splunk/8.0.6/Forwarding/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data_input

in few words:

you have to modify your outputs.conf, adding the second groupo and deleting the default group

[tcpout:systemGroup] server=server1:9997 [tcpout:applicationGroup] server=server2:9997

Then, in inputs.conf, you have to address each input

[monitor://.../file1.log] _TCP_ROUTING = systemGroup [monitor://.../file2.log] _TCP_ROUTING = applicationGroup

Ciao.

Giuseppe

Re: Splunk Default group

pankajupadhyay — Mon, 11 Jan 2021 09:25:12 GMT

@gcusello

As per below configuration is should send the data to vesxi but it is sending the logs to Indexers as well.

Can you please let me know is there any wrong with configuration ?

outputs.conf
[tcpout:Indexers]
server = 10.1.1.1:9996,10.1.1.2:9997

[tcpout:vesxi]
server = 10.20.20.20:519
sendCookedData = false
disabled = false

Transforms.conf

[vmwaresxilogs]
REGEX = (logged out|Rejected password for user|Cannot login|logged in as|Accepted user for user|was updated on host|Password was changed for account|Destroy VM called)
DEST_KEY = _TCP_ROUTING
FORMAT = vesxi

props.conf

[vmw-syslog]
TRANSFORMS-routing=vmwaresxilogs