Deployment Architecture

How to deploy Splunk HF to two indexers?

siuolkl
Explorer

hi experts

trying to deploy a HF and forward logs to 2 different indexers. clone data
i have 2 UFs feeding windows and syslog logs respectively to a HF.

This is my HF output conf, i think there some thing wrong here as i can only see logs at my indexer1

[tcpout]
defaultGroup=windows,syslog
[tcpout:windows,syslog]
server=indexer1 ip:9997

[tcpout:windows,syslog]
server=indexer2 ip:9997

appreciate any help.

 

siuolkl_0-1666083250996.png

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @siuolkl,

don't use default group:

[tcpout]

[tcpout:ABC_1]
server=indexer1_ip:9997

[tcpout:ABC_2]
server=indexer2;ip:9997

remember that the group names in the stanza headers (tcpout:...) must be different not the same.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @siuolkl,

don't use default group:

[tcpout]

[tcpout:ABC_1]
server=indexer1_ip:9997

[tcpout:ABC_2]
server=indexer2;ip:9997

remember that the group names in the stanza headers (tcpout:...) must be different not the same.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @siuolkl,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...