topic Re: How to send same data to multiple separate splunk instances- UF in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-send-same-data-to-multiple-separate-splunk-instances-UF/m-p/33789#M7206 <P>How does it work if not the defaultGroup, and we are using _TCP_ROUTING as in my example?</P> <P>i.e some data in default group is being sent instance A.</P> <P>we use tcp routing to send data to other locations.</P> <P>should this work?</P> <PRE><CODE>[monitor:///app/logs/work/*] _TCP_ROUTING=Location1;Location2 index = test1 sourcetype = work </CODE></PRE> Mon, 28 Sep 2020 14:34:02 GMT r999 2020-09-28T14:34:02Z How to send same data to multiple separate splunk instances- UF https://community.splunk.com/t5/Splunk-Search/How-to-send-same-data-to-multiple-separate-splunk-instances-UF/m-p/33786#M7203 <P>I have a splunk UF on a Linux server. (4.3.6)</P> <P>I want to send the local log files to 2 separate splunk instances, so both get a copy of the exact same data. (not autoLB across 2, not send different data to each one)</P> <P>how can I do this from a UF?</P> <P>Outputs.conf has two groups defined called Location1 and Location2</P> <P>like this</P> <P>1)specify multiple groups:</P> <PRE><CODE>[monitor:///app/logs/work/*] _TCP_ROUTING=Location1;Location2 index = test1 sourcetype = work </CODE></PRE> <P>2) repeat same monitor stanza:</P> <PRE><CODE>[monitor:///app/logs/work/*] _TCP_ROUTING=Location1 index = test1 sourcetype = work [monitor:///app/logs/work/*] _TCP_ROUTING=Location2 index = test1 sourcetype = work </CODE></PRE> <P>3) I though of using <CODE>indexAndForward</CODE> but I don’t want any transforms/props to take place from say Location1 before it sends to Location2, and I don’t really want Location 1 to be a dependency for Location2.</P> <P>Advice please</P> Tue, 13 Aug 2013 22:29:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-send-same-data-to-multiple-separate-splunk-instances-UF/m-p/33786#M7203 r999 2013-08-13T22:29:53Z Re: How to send same data to multiple separate splunk instances- UF https://community.splunk.com/t5/Splunk-Search/How-to-send-same-data-to-multiple-separate-splunk-instances-UF/m-p/33787#M7204 <P>Perhaps are you talking about Data Cloning?</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/Deploy/Configureforwarderswithoutputs.confd#Types_of_outputs.conf_files">http://docs.splunk.com/Documentation/Splunk/5.0.4/Deploy/Configureforwarderswithoutputs.confd#Types_of_outputs.conf_files</A></P> Tue, 13 Aug 2013 22:45:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-send-same-data-to-multiple-separate-splunk-instances-UF/m-p/33787#M7204 wagnerbianchi 2013-08-13T22:45:43Z Re: How to send same data to multiple separate splunk instances- UF https://community.splunk.com/t5/Splunk-Search/How-to-send-same-data-to-multiple-separate-splunk-instances-UF/m-p/33788#M7205 <P>[tcpout]<BR /> defaultGroup=indexer1,indexer2</P> <P>[tcpout:indexer1]<BR /> server=10.1.1.197:9997</P> <P>[tcpout:indexer2]<BR /> server=10.1.1.200:9997</P> <P>The forwarder will send duplicate data streams to the servers specified in both the indexer1 and indexer2 target groups.</P> Tue, 13 Aug 2013 22:58:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-send-same-data-to-multiple-separate-splunk-instances-UF/m-p/33788#M7205 lukejadamec 2013-08-13T22:58:58Z Re: How to send same data to multiple separate splunk instances- UF https://community.splunk.com/t5/Splunk-Search/How-to-send-same-data-to-multiple-separate-splunk-instances-UF/m-p/33789#M7206 <P>How does it work if not the defaultGroup, and we are using _TCP_ROUTING as in my example?</P> <P>i.e some data in default group is being sent instance A.</P> <P>we use tcp routing to send data to other locations.</P> <P>should this work?</P> <PRE><CODE>[monitor:///app/logs/work/*] _TCP_ROUTING=Location1;Location2 index = test1 sourcetype = work </CODE></PRE> Mon, 28 Sep 2020 14:34:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-send-same-data-to-multiple-separate-splunk-instances-UF/m-p/33789#M7206 r999 2020-09-28T14:34:02Z Re: How to send same data to multiple separate splunk instances- UF https://community.splunk.com/t5/Splunk-Search/How-to-send-same-data-to-multiple-separate-splunk-instances-UF/m-p/33790#M7207 <P>Use the below two .conf on the source where you are trying to send data !!!!</P> <P>inputs.conf </P> <P>[monitor:///app/logs/work/*]<BR /> sourcetype = work<BR /> index = test1</P> <P>outputs.conf</P> <P>[tcpout]<BR /> defaultGroup=indexerGroup1,indexerGroup2</P> <P>[tcpout:indexerGroup1]<BR /> server=server1:9997</P> <P>[tcpout:indexerGroup2]<BR /> server=server2:9997</P> <P>At the receiver side have the below configuration.</P> <P>inputs.conf</P> <P>[splunktcp://9997]</P> <P>[splunktcp://9997]<BR /> _TCP_ROUTING=indexerGroup1</P> <P>[splunktcp://9997]<BR /> _TCP_ROUTING=indexerGroup2</P> <P>Regards,<BR /> Arun</P> Tue, 29 Sep 2020 15:34:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-send-same-data-to-multiple-separate-splunk-instances-UF/m-p/33790#M7207 arunsunny 2020-09-29T15:34:54Z