Deployment Architecture

several host subset send other splunk-server?

khyoung7410
Communicator

hi


I have a three host in indexer.

I'm only one host, send another splunk-server.

but, all host send another splunk-server.

where is bug?

thanks

-- inputs.conf --

[udp://514] 
connection_host = ip 
index = main 
sourcetype = test_syslog 
disabled = 0

-- props.conf --

[host::192.168.1.5]
TRANSFORMS-data1 = change-index1, change-source1, fw-forward 

[host::192.168.1.4] 
TRANSFORMS-data2 = change-index2, change-source2 

[host::192.168.1.3] 
TRANSFORMS-data3 = change-index3, change-source3 

-- transforms.conf --

[change-index1]
DEST_KEY = _MetaData:Index
REGEX=.
FORMAT = IDX_1

[change-source1]
DEST_KEY = MetaData:Source
REGEX=.
FORMAT = source::firewall-1

[fw-forward]
REGEX=.
DEST_KEY = _TCP_ROUTING
FORMAT = a-output

-- outputs.conf --

[tcpout]
defaultGroup = a-output
indexAndForward = 1

[tcpout:a-output]
autoLB=true
server=192.168.1.5:9004

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Hi,

The big problem seems to be that you, by default in outputs.conf, send all events to a-output, and then have a special configuration for your FW-data in transforms.conf to send it to the same place (a-output).

Also, the destination seems to be the host where data originated (192.168.1.5), which seems a bit odd.


UPDATE:

add an extra (group of) indexer(s) in the outputs.conf that specifies a separate indexer. There is no need to set autoLB=true, since that is a default value.

[tcpout]
defaultGroup = a-output
indexAndForward = 1

[tcpout:a-output]
server=your_ordinary_indexer:port

[tcpout:fw-group]
server=your_firewall_indexer:port

Then you use the transform for the firewall data to use fw-group instead of a-output.

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

Hi,

The big problem seems to be that you, by default in outputs.conf, send all events to a-output, and then have a special configuration for your FW-data in transforms.conf to send it to the same place (a-output).

Also, the destination seems to be the host where data originated (192.168.1.5), which seems a bit odd.


UPDATE:

add an extra (group of) indexer(s) in the outputs.conf that specifies a separate indexer. There is no need to set autoLB=true, since that is a default value.

[tcpout]
defaultGroup = a-output
indexAndForward = 1

[tcpout:a-output]
server=your_ordinary_indexer:port

[tcpout:fw-group]
server=your_firewall_indexer:port

Then you use the transform for the firewall data to use fw-group instead of a-output.

Hope this helps,

Kristian

khyoung7410
Communicator

kristian.
The problem was solved.
thank you.

0 Karma

kristian_kolb
Ultra Champion

Please mark it as answered and/or upvote if this solved your problem. Thanks. /k

0 Karma

khyoung7410
Communicator

Thanks you for answer my question.

0 Karma

kristian_kolb
Ultra Champion

see update above. /k

0 Karma

khyoung7410
Communicator

Do you know how?

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...