Archive

Multiple fowarders on single server?

New Member

Can I have multiple forwarders installed on a single server forwarding to different Splunk servers?

For example: Forwarder #1 is monitoring apache logs and forwarding to Splunk server 1. Forwarder #2 is monitoring OS related logs and forwarding to Splunk server 2.

Tags (1)
0 Karma

Engager

Hi,
Can you explain this a little further?
I have a similar situation where I need different data to be sent to two indexers from a single server.

0 Karma

Splunk Employee
Splunk Employee

Yes you could, but it probably isn't necessary. You can define different output groups in outputs.conf, and specify which output group a particular input goes to in inputs.conf using the _TCP_ROUTING setting.

Engager

Hi, Can you explain this a little further? I have a similar situation where I need different data to be sent to two indexers from a single server.

0 Karma