Deployment Architecture

How to deploy Splunk HF to two indexers?

siuolkl
Explorer

hi experts

trying to deploy a HF and forward logs to 2 different indexers. clone data
i have 2 UFs feeding windows and syslog logs respectively to a HF.

This is my HF output conf, i think there some thing wrong here as i can only see logs at my indexer1

[tcpout]
defaultGroup=windows,syslog
[tcpout:windows,syslog]
server=indexer1 ip:9997

[tcpout:windows,syslog]
server=indexer2 ip:9997

appreciate any help.

 

siuolkl_0-1666083250996.png

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @siuolkl,

don't use default group:

[tcpout]

[tcpout:ABC_1]
server=indexer1_ip:9997

[tcpout:ABC_2]
server=indexer2;ip:9997

remember that the group names in the stanza headers (tcpout:...) must be different not the same.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @siuolkl,

don't use default group:

[tcpout]

[tcpout:ABC_1]
server=indexer1_ip:9997

[tcpout:ABC_2]
server=indexer2;ip:9997

remember that the group names in the stanza headers (tcpout:...) must be different not the same.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @siuolkl,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...