Deployment Architecture

several host subset send other splunk-server?

khyoung7410
Communicator

hi


I have a three host in indexer.

I'm only one host, send another splunk-server.

but, all host send another splunk-server.

where is bug?

thanks

-- inputs.conf --

[udp://514] 
connection_host = ip 
index = main 
sourcetype = test_syslog 
disabled = 0

-- props.conf --

[host::192.168.1.5]
TRANSFORMS-data1 = change-index1, change-source1, fw-forward 

[host::192.168.1.4] 
TRANSFORMS-data2 = change-index2, change-source2 

[host::192.168.1.3] 
TRANSFORMS-data3 = change-index3, change-source3 

-- transforms.conf --

[change-index1]
DEST_KEY = _MetaData:Index
REGEX=.
FORMAT = IDX_1

[change-source1]
DEST_KEY = MetaData:Source
REGEX=.
FORMAT = source::firewall-1

[fw-forward]
REGEX=.
DEST_KEY = _TCP_ROUTING
FORMAT = a-output

-- outputs.conf --

[tcpout]
defaultGroup = a-output
indexAndForward = 1

[tcpout:a-output]
autoLB=true
server=192.168.1.5:9004

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Hi,

The big problem seems to be that you, by default in outputs.conf, send all events to a-output, and then have a special configuration for your FW-data in transforms.conf to send it to the same place (a-output).

Also, the destination seems to be the host where data originated (192.168.1.5), which seems a bit odd.


UPDATE:

add an extra (group of) indexer(s) in the outputs.conf that specifies a separate indexer. There is no need to set autoLB=true, since that is a default value.

[tcpout]
defaultGroup = a-output
indexAndForward = 1

[tcpout:a-output]
server=your_ordinary_indexer:port

[tcpout:fw-group]
server=your_firewall_indexer:port

Then you use the transform for the firewall data to use fw-group instead of a-output.

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

Hi,

The big problem seems to be that you, by default in outputs.conf, send all events to a-output, and then have a special configuration for your FW-data in transforms.conf to send it to the same place (a-output).

Also, the destination seems to be the host where data originated (192.168.1.5), which seems a bit odd.


UPDATE:

add an extra (group of) indexer(s) in the outputs.conf that specifies a separate indexer. There is no need to set autoLB=true, since that is a default value.

[tcpout]
defaultGroup = a-output
indexAndForward = 1

[tcpout:a-output]
server=your_ordinary_indexer:port

[tcpout:fw-group]
server=your_firewall_indexer:port

Then you use the transform for the firewall data to use fw-group instead of a-output.

Hope this helps,

Kristian

khyoung7410
Communicator

kristian.
The problem was solved.
thank you.

0 Karma

kristian_kolb
Ultra Champion

Please mark it as answered and/or upvote if this solved your problem. Thanks. /k

0 Karma

khyoung7410
Communicator

Thanks you for answer my question.

0 Karma

kristian_kolb
Ultra Champion

see update above. /k

0 Karma

khyoung7410
Communicator

Do you know how?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...