All Apps and Add-ons

Sending AWS data from heavy forwarder to indexer


Our splunk environment consists of a Universal Forwarder, Heavy forwarder and Indexer.

We are importing our AWS cloudtrail data from an S3 bucket using SQS via the AWS Add on. I have configured this on the HF which has created a config entry under {SplunkApp}/etc/apps/SplunkTAaws/local/inputs.conf

account = MY-EC2-ROLE
awsiamrole = Splunk
index = awsfwd
interval = 300
filedecoder = CloudTrail
sourcetype =
batchsize = 100
queueregion = eu-west-2
queue_url = https://account/queuename
disabled = 0

When you create an input type it requires an index to send the data (here it's aws_fwd). However I want to send this on to the indexer in a seperate index. How can I specify this so the data goes from AWS into the HF and then onto the indexer? The HF > Indexer output is configured on port 9997 - any help would be great.

0 Karma

Re: Sending AWS data from heavy forwarder to indexer


If you are trying to route data to multiple sets of indexer you want using the routing and filtering options of the HF.

Here is the the Splunk Doc - Route and filter data

0 Karma