Getting Data In

Can i use outputs.conf to send some data to one splunk environment and other data to another splunk environment?

Path Finder

I work for a managed service provider.
We use Splunk to monitor servers for our clients.
One of our clients has built their own splunk instance, and wants us to forward their app log data (which we don't currently ingest) to their splunk instance.

I know that i can send data to 2 splunk environments, but my question is can i choose which data goes to which environment?
i.e. we don't want to send their log data to our environment as we are only interested in perfmon, wineventlog etc.

Thanks

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

We have some UFs that send data to our Splunk and then some data to another Splunk instance internally for a different team. We push an inputs.conf and an outputs.conf to do it. Index name needs to be same on both instances (at least that is what I do). Samples below:

inputs.conf
[WinEventLog://Security]
_TCP_ROUTING = server2.foo.com
disabled = 0
index = winseclog

outputs.conf
[tcpout:group1]
autoLBFrequency = 30
forceTimebasedAutoLB = true
useACK=true

[tcpout]
defaultGroup = group1
forwardedindex.0.whitelist = .*
indexAndForward = 0

[tcpout:server2.foo.com]
maxQueueSize = 10MB
server = server2.foo.com:9997

0 Karma

SplunkTrust
SplunkTrust

Refer to routing and filtering data

In particular the section "Route inputs to specific indexers based on the data input" may be your best option...the document explains what to do

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!