Deployment Architecture

Forward splunk app log from search head to the indexer within the same cluster

shangshin
Builder

Hi,
I installed splunk add-on app on one of the search heads. The log generated by the add-on app needs to be forwarded to its indexers so it will be visible on the other search head.

Can someone advise what config change needs to be done to achieve the goal?

Thanks in advance!

Tags (2)
0 Karma

gfuente
Motivator

Hello

You just need to configure the outputs.conf in the SH so it forwards the data to the indexers, so the other SH can search that data

Regards

shangshin
Builder

Thanks again for the response. Let use the website monitoring app ( http://apps.splunk.com/app/1493/ ) as an example.

The app is pinging urls and saves the result on the search head. How can I forward the result to the indexers?

The stanza you provided above will forward "all logs" to the indexer 10.1.1.197 over tcp port 9997. I just want to forward the log generated by website monitoring app. How can I achieve this?

Thank you very much!

0 Karma

gfuente
Motivator

What add-on are you talking about?, so we can help you better

The indexer doesn´t need to know about fields, it just need the proper timestamp and event breaking configuration. The fields are extracted at search time, so maybe you need to copy the fields extraction into the other SH.

regarding hot wo configure outputs.conf check the docs:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf

An example:
[tcpout:group1]
server=10.1.1.197:9997

regards

shangshin
Builder

Thanks for the response. Do you know if there is any app provide more detail steps on how to set this up?

I am asking this because the log generated by the splunk add-on app has meaning fields. How would the indexers know?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...