How to send data to two output types, [tcpout] and [httpout]?

[rasikmhetre]

I need help in sending data to two output types, [tcpout] and [httpout].

Is this possible? Because when I am using outputs.conf and pointing it to two output types, I can only see data to [httpout] https://hecendpoint:8088 and data is not going to another indexer which is of [tcpout] indexerip:9997

[awelborn]

---

@rasikmhetre wrote:

I need help in sending data to two output types, [tcpout] and [httpout].

Is this possible? Because when I am using outputs.conf and pointing it to two output types, I can only see data to [httpout] https://hecendpoint:8088 and data is not going to another indexer which is of [tcpout] indexerip:9997

---

No, you can not use [httpout] in tandem with either [tcpout] or [syslog].  The following text states this is true for UFs and light forwarders.  It also states httpout is only supported on UFs but it works on HFs as well. I've tested with both httpout and tcpout but httpout will take precedence every-time. 

https://docs.splunk.com/Documentation/Forwarder/9.0.3/Forwarder/Configureforwardingwithoutputs.conf 

Configure the universal forwarder to send data over hyper text transfer protocol (HTTP) between Splunk platform instances when you are unable to open network traffic to use the Splunk to Splunk (S2S) service. A Splunk universal forwarder instance can perform either httpout or tcpout, but not both at the same time. There is currently no support to send ACKs to the client transaction.

To configure a universal forwarder to send data over HTTP, add an httpout stanza to the outputs.conf file on your universal forwarder.

It also states that 

[gcusello]

Hi @rasikmhetre,

yes, it's possible, you can see how at https://docs.splunk.com/Documentation/Splunk/9.0.0/Forwarding/Routeandfilterdatad.

In few words, you have to configure in the outputs.conf of your target both the destinations and all the logs will be sent to both the destinations.

If you want, you can also be selective in the logs choose.

Ciao.

Giuseppe

[rasikmhetre]

Thanks for your reply, I did find this document and implemented it in the same way but i am not able get any data on the indexer which is the [tcpout] block in outputs.conf, I am able to get the data on my HEC which is my [httpout] in outputs.conf.

[gcusello]

Hi @rasikmhetre,

could you share your outputs.conf?

Ciao.

Giuseppe

[rasikmhetre]

Hello @gcusello 

[tcpout]
server = indexerip:9997
disabled = false

[httpout:target2]
httpEventCollectorToken = <hec token>
uri = http://hecip:8088
disabled = false

[gcusello]

Hi @rasikmhetre,

configuration seems to be correct, are you sure that there isn't any other block (e.g. firewall)?

can you reach the Indexer via telnet from the client?

I'm sure that you enabled receiving on the Indexer.

What does it happen if you disable httpout output?

Ciao.

Giuseppe

[rasikmhetre]

@gcusello yes I am able to reach the indexer, I am able to see Connected to idx:9997 in my log. Trying to disable httpout now

[rasikmhetre]

@gcusello httpout ingestion stopped now, but even tcpout is blank. 

[rasikmhetre]

hello @gcusello I replicated the same thing in another environment and it worked, the only thing I changed is in tcpout's default stanza:

[tcpout]

defaultGroup = splunk-index-cluster,hec-group

Now it started sending data to both destinations. Thanks and Appreciate your help!! 

[gcusello]

Hi @rasikmhetre,

good for you, see next time!

Please accept one answer for the other people of Community

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[rasikmhetre]

hey @gcusello came here to mark the answer, and just now noticed that data has stopped coming to my HEC, and google says:

A Splunk universal forwarder instance can perform either httpout or tcpout, but not both at the same time. 

😥

[gcusello]

Hi @rasikmhetre,

I didn't know this: I sent logs using tcpout and syslogss without problems, anyway, if your need is to send logs to a third party and to a Splunk Indexer, you could try from an Indexer or (if present) an Heavy Forwarder.

Ciao.

Giuseppe