All Apps and Add-ons

Route to Indexer by app

nickstone
Path Finder

Im sure there is a straight forward way to do this with Enterprise, however when using Splunk Cloud; what is the best practice for forwarding the output of an app to a different indexer from Splunk Cloud?

Can I configure the app to have its own outputs.conf and not affect the other apps?

Or do I need to add the tcp routing string to the inputs.conf?

Tags (1)
0 Karma

gfuente
Motivator

Hello

Do you have an hybrid enviroment?

If you only have Splunk Cloud, then you should send all data to all indexers, so use the default settings that you get with the Forwarder app that you download from you Splunk Cloud instance.

Maybe you are referring to indexes instead of indexers?

Regards

0 Karma

nickstone
Path Finder

No I mean Indexers. as in the Splunk instance, not the bucket of data.

No hybrid

I have an Indexer that a special security department needs physically seperated and I need the output of their apps to go to a different Indexer, but I don't want duplicate heavy forwarders

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Indexes are physically separated, as in on disk they are separated and in Splunk, you use RBAC to grant access to these indexes.

Is that what you are wanting to do? Or are you wanting to send a second stream of data for specific indexes to a different group of indexers?

0 Karma

gfuente
Motivator

Then, the way to go is setting different outputs groups ,and then input by input define the output group with the tcp routing setting, as you proposed

regards

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...