In my Splunk forwarder, we were monitoring data and forwarding in one splunk instance, Now I need to add one more receiver in forwarder. 1 forwarder 2 receivers.
I did as below but after config, I am not getting any indexed data, even first splunk instances stop received any data.
below is my config files for input.conf and out.conf for Splunk Forwarder:
# first splunk instance [WinHostMon://Service] _TCP_ROUTING = default-autolb-group type = service interval = 300 disabled = 0 index = index_logs # second splunk instance [monitor://D:\SATS\SecureLog\*\Logs_Status\*] _TCP_ROUTING = default-autolb-group2 disabled = 0 index = index-stats sourcetype = index:stats:gl crcSalt = <SOURCE>
[tcpout] defaultGroup = default-autolb-group, default-autolb-group2 [tcpout:default-autolb-group] server = xxx.xx.xx.xxx:9997 [tcpout-server://xxx.xx.xx.xxx:9997] [tcpout:default-autolb-group2] server = yy.yy.yyy.yyy:9997 [tcpout-server://yy.yy.yyy.yyy:9997]
Please suggest. Thanks in advance.
server = xxx.xxx.xxx.xxx:9997
disabled = false
disabled = false
If you want to forward logs to both the Indexers it's sufficient to use this outputs.conf, if you want selectively send some logs to one Indexer and other to the second, you have to insert in each stanza of your inputs.conf _TCP_ROUTING = ,,, ...
hi dyude @dhirendra761 ,
its inputs.conf and outputs.conf, you can check the spelling. if it's proper then you can give this a shot...
[tcpout:Group1] server=server1:9997 [tcpout:Group2] server=server2:9997
[WinHostMon://Service] _TCP_ROUTING = Group1 [monitor://D:\SATS\SecureLog\*\Logs_Status\*] _TCP_ROUTING = Group2