several host subset send other splunk-server?

[khyoung7410]

hi

I have a three host in indexer.

I'm only one host, send another splunk-server.

but, all host send another splunk-server.

where is bug?

thanks

-- inputs.conf --

[udp://514] 
connection_host = ip 
index = main 
sourcetype = test_syslog 
disabled = 0

-- props.conf --

[host::192.168.1.5]
TRANSFORMS-data1 = change-index1, change-source1, fw-forward 

[host::192.168.1.4] 
TRANSFORMS-data2 = change-index2, change-source2 

[host::192.168.1.3] 
TRANSFORMS-data3 = change-index3, change-source3 

-- transforms.conf --

[change-index1]
DEST_KEY = _MetaData:Index
REGEX=.
FORMAT = IDX_1

[change-source1]
DEST_KEY = MetaData:Source
REGEX=.
FORMAT = source::firewall-1

[fw-forward]
REGEX=.
DEST_KEY = _TCP_ROUTING
FORMAT = a-output

-- outputs.conf --

[tcpout]
defaultGroup = a-output
indexAndForward = 1

[tcpout:a-output]
autoLB=true
server=192.168.1.5:9004

---

[kristian_kolb · Accepted solution]

Hi,

The big problem seems to be that you, by default in outputs.conf, send all events to a-output, and then have a special configuration for your FW-data in transforms.conf to send it to the same place (a-output).

Also, the destination seems to be the host where data originated (192.168.1.5), which seems a bit odd.

---

UPDATE:

add an extra (group of) indexer(s) in the outputs.conf that specifies a separate indexer. There is no need to set autoLB=true, since that is a default value.

[tcpout]
defaultGroup = a-output
indexAndForward = 1

[tcpout:a-output]
server=your_ordinary_indexer:port

[tcpout:fw-group]
server=your_firewall_indexer:port

Then you use the transform for the firewall data to use fw-group instead of a-output.

Hope this helps,

Kristian

[khyoung7410]

kristian.
The problem was solved.
thank you.

[kristian_kolb]

Please mark it as answered and/or upvote if this solved your problem. Thanks. /k

[khyoung7410]

Thanks you for answer my question.

[kristian_kolb]

see update above. /k

[khyoung7410]

Do you know how?