Multiple fowarders on single server?

[jlicalsi]

Can I have multiple forwarders installed on a single server forwarding to different Splunk servers?

For example: Forwarder #1 is monitoring apache logs and forwarding to Splunk server 1. Forwarder #2 is monitoring OS related logs and forwarding to Splunk server 2.

[MJ]

Hi,
Can you explain this a little further?
I have a similar situation where I need different data to be sent to two indexers from a single server.

[gkanapathy]

Yes you could, but it probably isn't necessary. You can define different output groups in outputs.conf, and specify which output group a particular input goes to in inputs.conf using the _TCP_ROUTING setting.

[MJ]

Hi, Can you explain this a little further? I have a similar situation where I need different data to be sent to two indexers from a single server.