Deployment Architecture

Splunk forward data not sending to multiple splunk receiver

dhirendra761
Contributor

Hi All,

In my Splunk forwarder, we were monitoring data and forwarding in one splunk instance, Now I need to add one more receiver in forwarder. 1 forwarder 2 receivers.

I did as below but after config, I am not getting any indexed data, even first splunk instances stop received any data.
below is my config files for input.conf and out.conf for Splunk Forwarder:

input.conf

# first splunk instance
[WinHostMon://Service]
 _TCP_ROUTING = default-autolb-group
type = service
interval = 300
disabled = 0
index = index_logs

# second splunk instance

[monitor://D:\SATS\SecureLog\*\Logs_Status\*]
 _TCP_ROUTING = default-autolb-group2
disabled = 0
index = index-stats
sourcetype = index:stats:gl
crcSalt = <SOURCE>

output.conf

[tcpout]
defaultGroup = default-autolb-group, default-autolb-group2

[tcpout:default-autolb-group]
server = xxx.xx.xx.xxx:9997

[tcpout-server://xxx.xx.xx.xxx:9997]

[tcpout:default-autolb-group2]
server = yy.yy.yyy.yyy:9997
[tcpout-server://yy.yy.yyy.yyy:9997]

Please suggest. Thanks in advance.
-dhirendra

0 Karma

harish_l
New Member

[tcpout:Indexer1]
server = xxx.xxx.xxx.xxx:9997
disabled = false
[tcpout-server://xxx.xxx.xxx.xxx:9997]

[tcpout:Indexer2]
server=yyy.yyy.yyy.yyy:9997
disabled = false
[tcpout-server://yyy.yyy.yyy.yyy:9997]

If you want to forward logs to both the Indexers it's sufficient to use this outputs.conf, if you want selectively send some logs to one Indexer and other to the second, you have to insert in each stanza of your inputs.conf _TCP_ROUTING = ,,, ...

See http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

0 Karma

vinod94
Contributor

hi dyude @dhirendra761 ,

its inputs.conf and outputs.conf, you can check the spelling. if it's proper then you can give this a shot...

outputs.conf

[tcpout:Group1]
server=server1:9997

[tcpout:Group2]
server=server2:9997

inputs.conf

[WinHostMon://Service]
_TCP_ROUTING = Group1

[monitor://D:\SATS\SecureLog\*\Logs_Status\*]
_TCP_ROUTING = Group2
0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...