topic Remotely deploy universal forwarder so that it forwards data two multiple inderxers in Splunk Search

Remotely deploy universal forwarder so that it forwards data two multiple inderxers

rajbahak — Mon, 28 Sep 2020 11:22:03 GMT

Hello,

I need to be able to configure universal forwarder with more than one indexing server from the command line.

The example below has only one receiving indexer. What is the best way to configure more than one receiving index server from the command line?

msiexec.exe /i splunkuniversalforwarder_x86.msi RECEIVING_INDEXER="indexer1:9997"

Thanks a lot for your time/help.

Re: Remotely deploy universal forwarder so that it forwards data two multiple inderxers

Takajian — Thu, 09 Feb 2012 05:58:36 GMT

You can forward data to cloned targets. But you need to configure outputs.conf.

The following configuration should enable cloning. Set the following in outputs.conf:

[tcpout]
defaultGroup = group1, group2 # Clone data to group1 and group2

[tcpout:group1]
server = indexer1:9997

[tcpout:group2]
server = indexer2:9997
sendCookedData = false # Send raw TCP data(logs read by splunk)

Re: Remotely deploy universal forwarder so that it forwards data two multiple inderxers

rajbahak — Thu, 09 Feb 2012 17:13:47 GMT

Hey Takajian,

Thanks for your reply. I am aware of the outputs.conf configuration that you've mentioned above. I was interested to know if the same could be achieved from a command line so that I did not have to go and edit the conf file after installing the universal forwarder..

Thanks again