All Apps and Add-ons
Highlighted

Sending AWS data from heavy forwarder to indexer

Explorer

Our splunk environment consists of a Universal Forwarder, Heavy forwarder and Indexer.

We are importing our AWS cloudtrail data from an S3 bucket using SQS via the AWS Add on. I have configured this on the HF which has created a config entry under {SplunkApp}/etc/apps/SplunkTAaws/local/inputs.conf

[awssqsbaseds3://CloudTrail]
aws
account = MY-EC2-ROLE
awsiamrole = Splunk
index = awsfwd
interval = 300
s3
filedecoder = CloudTrail
sourcetype =
sqs
batchsize = 100
sqs
queueregion = eu-west-2
sqs
queue_url = https://account/queuename
disabled = 0

When you create an input type it requires an index to send the data (here it's aws_fwd). However I want to send this on to the indexer in a seperate index. How can I specify this so the data goes from AWS into the HF and then onto the indexer? The HF > Indexer output is configured on port 9997 - any help would be great.

0 Karma
Highlighted

Re: Sending AWS data from heavy forwarder to indexer

Champion

If you are trying to route data to multiple sets of indexer you want using the routing and filtering options of the HF.

Here is the the Splunk Doc - Route and filter data

0 Karma