How to route data collected by Splunk Stream to a different indexer?

[janispelss]

I've been trying to test the Splunk Stream ap to collect some data I need from a Windows server. The forwarder installed on that server is already collecting some other data and sending it to the production cluster, and obviously I want to keep doing that. But since I'm still just testing the Splunk Stream app, I'd like to send data from it to a dev indexer, but I can't get that to work.

I have added the output group for the dev indexer to the forwarder, without setting it as the default output group in outputs.conf. This part seems to work correctly, since the internal logs of that forwarder are now sent both to the prod cluster and the dev indexer. However, adding it to the _TCP_ROUTING parameter in inputs.conf of the Splunk_TA_stream doesn't work. I've tried adding it to both [default] and [streamfwd://streamfwd] stanzas.

Other than that, the data collection seems to be working fine, and I can control what is being collected using the app installed on the dev indexer.

Would anyone be able to help with this?

[dmuegge_splunk]

Just as an update to this post as it may be out of date. I was able to successfully test _TCP_ROUTING for stream. The documentation at https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad under the heading "Route inputs to specific indexers based on the data input" does work for the stream input.

[esix_splunk]

First, you need to be using a Heavy Forwarder, and not a Universal Forwarder. Which do you have in your environment? Make sure you read the following : http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

It outlines requirements to do what you are describing.

Aside from the, run btool against your outputs on that forwarder and make sure your configuration is applied.

[janispelss]

So for the Splunk Stream inputs do I have to use props.conf and transforms.conf on a heavy forwarder? For other cases where I want to send different inputs to different indexers, I have been successfully using inputs.conf and outputs.conf on a Universal Forwarder, like in the "Route inputs to specific indexers based on the data input" of the documentation page you linked.

[dmuegge_splunk]

I know this is older but I ran across this post when testing this scenario. The _TCP_ROUTING method in "Route inputs to specific indexers based on the data input" in the docs worked as advertised with the stream input for me.