Deployment Architecture

several host subset send other splunk-server?

khyoung7410
Communicator

hi


I have a three host in indexer.

I'm only one host, send another splunk-server.

but, all host send another splunk-server.

where is bug?

thanks

-- inputs.conf --

[udp://514] 
connection_host = ip 
index = main 
sourcetype = test_syslog 
disabled = 0

-- props.conf --

[host::192.168.1.5]
TRANSFORMS-data1 = change-index1, change-source1, fw-forward 

[host::192.168.1.4] 
TRANSFORMS-data2 = change-index2, change-source2 

[host::192.168.1.3] 
TRANSFORMS-data3 = change-index3, change-source3 

-- transforms.conf --

[change-index1]
DEST_KEY = _MetaData:Index
REGEX=.
FORMAT = IDX_1

[change-source1]
DEST_KEY = MetaData:Source
REGEX=.
FORMAT = source::firewall-1

[fw-forward]
REGEX=.
DEST_KEY = _TCP_ROUTING
FORMAT = a-output

-- outputs.conf --

[tcpout]
defaultGroup = a-output
indexAndForward = 1

[tcpout:a-output]
autoLB=true
server=192.168.1.5:9004

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Hi,

The big problem seems to be that you, by default in outputs.conf, send all events to a-output, and then have a special configuration for your FW-data in transforms.conf to send it to the same place (a-output).

Also, the destination seems to be the host where data originated (192.168.1.5), which seems a bit odd.


UPDATE:

add an extra (group of) indexer(s) in the outputs.conf that specifies a separate indexer. There is no need to set autoLB=true, since that is a default value.

[tcpout]
defaultGroup = a-output
indexAndForward = 1

[tcpout:a-output]
server=your_ordinary_indexer:port

[tcpout:fw-group]
server=your_firewall_indexer:port

Then you use the transform for the firewall data to use fw-group instead of a-output.

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

Hi,

The big problem seems to be that you, by default in outputs.conf, send all events to a-output, and then have a special configuration for your FW-data in transforms.conf to send it to the same place (a-output).

Also, the destination seems to be the host where data originated (192.168.1.5), which seems a bit odd.


UPDATE:

add an extra (group of) indexer(s) in the outputs.conf that specifies a separate indexer. There is no need to set autoLB=true, since that is a default value.

[tcpout]
defaultGroup = a-output
indexAndForward = 1

[tcpout:a-output]
server=your_ordinary_indexer:port

[tcpout:fw-group]
server=your_firewall_indexer:port

Then you use the transform for the firewall data to use fw-group instead of a-output.

Hope this helps,

Kristian

khyoung7410
Communicator

kristian.
The problem was solved.
thank you.

0 Karma

kristian_kolb
Ultra Champion

Please mark it as answered and/or upvote if this solved your problem. Thanks. /k

0 Karma

khyoung7410
Communicator

Thanks you for answer my question.

0 Karma

kristian_kolb
Ultra Champion

see update above. /k

0 Karma

khyoung7410
Communicator

Do you know how?

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...