hi
I have a three host in indexer.
I'm only one host, send another splunk-server.
but, all host send another splunk-server.
where is bug?
thanks
-- inputs.conf --
[udp://514]
connection_host = ip
index = main
sourcetype = test_syslog
disabled = 0
-- props.conf --
[host::192.168.1.5]
TRANSFORMS-data1 = change-index1, change-source1, fw-forward
[host::192.168.1.4]
TRANSFORMS-data2 = change-index2, change-source2
[host::192.168.1.3]
TRANSFORMS-data3 = change-index3, change-source3
-- transforms.conf --
[change-index1]
DEST_KEY = _MetaData:Index
REGEX=.
FORMAT = IDX_1
[change-source1]
DEST_KEY = MetaData:Source
REGEX=.
FORMAT = source::firewall-1
[fw-forward]
REGEX=.
DEST_KEY = _TCP_ROUTING
FORMAT = a-output
-- outputs.conf --
[tcpout]
defaultGroup = a-output
indexAndForward = 1
[tcpout:a-output]
autoLB=true
server=192.168.1.5:9004
Hi,
The big problem seems to be that you, by default in outputs.conf
, send all events to a-output
, and then have a special configuration for your FW-data in transforms.conf
to send it to the same place (a-output
).
Also, the destination seems to be the host where data originated (192.168.1.5), which seems a bit odd.
UPDATE:
add an extra (group of) indexer(s) in the outputs.conf
that specifies a separate indexer. There is no need to set autoLB=true, since that is a default value.
[tcpout]
defaultGroup = a-output
indexAndForward = 1
[tcpout:a-output]
server=your_ordinary_indexer:port
[tcpout:fw-group]
server=your_firewall_indexer:port
Then you use the transform for the firewall data to use fw-group
instead of a-output
.
Hope this helps,
Kristian
Hi,
The big problem seems to be that you, by default in outputs.conf
, send all events to a-output
, and then have a special configuration for your FW-data in transforms.conf
to send it to the same place (a-output
).
Also, the destination seems to be the host where data originated (192.168.1.5), which seems a bit odd.
UPDATE:
add an extra (group of) indexer(s) in the outputs.conf
that specifies a separate indexer. There is no need to set autoLB=true, since that is a default value.
[tcpout]
defaultGroup = a-output
indexAndForward = 1
[tcpout:a-output]
server=your_ordinary_indexer:port
[tcpout:fw-group]
server=your_firewall_indexer:port
Then you use the transform for the firewall data to use fw-group
instead of a-output
.
Hope this helps,
Kristian
kristian.
The problem was solved.
thank you.
Please mark it as answered and/or upvote if this solved your problem. Thanks. /k
Thanks you for answer my question.
see update above. /k
Do you know how?